Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-12648


Buffer overflow in TIFF data EXIF tag processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw firmware v05.04 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw firmware v05.04 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw firmware v05.04 and earlier sold in Europe.


Security Impact Summary

This vulnerability carries a CRITICAL severity rating with a CVSS v3.1 score of 9.8, indicating it can be exploited remotely over the network with relatively low complexity without requiring user interaction and does not require pre-existing privileges . The vulnerability impacts confidentiality (data exposure), integrity (unauthorized modifications), and availability (service disruption) for affected systems. Impacting 44 products from canon, from canon, from canon and 41 others, organizations running these solutions should prioritize assessment and patching.

Historical Context

Reported in 2025, this vulnerability emerged during an era marked by increased sophistication in supply chain attacks, cloud infrastructure vulnerabilities, and software-as-a-service (SaaS) security challenges. Security practices during this period emphasized zero-trust architectures, container security, and API protection.


Published

2025-01-28T01:15:08.700

Last Modified

2026-01-26T15:08:11.990

Status

Analyzed

Source

f98c90f0-e9bd-4fa7-911b-51993f3571fd

Severity

CVSSv3.1: 9.8 (CRITICAL)

Weaknesses
  • Type: Secondary
    CWE-787

Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System canon mf455dw_firmware ≤ 05.04 Yes
Hardware canon mf455dw - No
Operating System canon mf453dw_firmware ≤ 05.04 Yes
Hardware canon mf453dw - No
Operating System canon mf452dw_firmware ≤ 05.04 Yes
Hardware canon mf452dw - No
Operating System canon mf451dw_firmware ≤ 05.04 Yes
Hardware canon mf451dw - No
Operating System canon mf465dw_firmware ≤ 05.04 Yes
Hardware canon mf465dw - No
Operating System canon mf462dw_firmware ≤ 05.04 Yes
Hardware canon mf462dw - No
Operating System canon mf656cdw_firmware ≤ 05.04 Yes
Hardware canon mf656cdw - No
Operating System canon mf654cdw_firmware ≤ 05.04 Yes
Hardware canon mf654cdw - No
Operating System canon mf653cdw_firmware ≤ 05.04 Yes
Hardware canon mf653cdw - No
Operating System canon mf652cw_firmware ≤ 05.04 Yes
Hardware canon mf652cw - No
Operating System canon mf1238_ii_firmware ≤ 05.04 Yes
Hardware canon mf1238_ii - No
Operating System canon mf1440_firmware ≤ 05.04 Yes
Hardware canon mf1440 - No
Operating System canon mf1643if_ii_firmware ≤ 05.04 Yes
Hardware canon mf1643if_ii - No
Operating System canon mf1643i_ii_firmware ≤ 05.04 Yes
Hardware canon mf1643i_ii - No
Operating System canon lbp237dw_firmware ≤ 05.04 Yes
Hardware canon lbp237dw - No
Operating System canon lbp236dw_firmware ≤ 05.04 Yes
Hardware canon lbp236dw - No
Operating System canon lbp247dw_firmware ≤ 05.04 Yes
Hardware canon lbp247dw - No
Operating System canon lbp246dw_firmware ≤ 05.04 Yes
Hardware canon lbp246dw - No
Operating System canon lbp633cdw_firmware ≤ 05.04 Yes
Hardware canon lbp633cdw - No
Operating System canon lbp632cdw_firmware ≤ 05.04 Yes
Hardware canon lbp632cdw - No
Operating System canon lbp1238_ii_firmware ≤ 05.04 Yes
Hardware canon lbp1238_ii - No
Operating System canon lbp1440_firmware ≤ 05.04 Yes
Hardware canon lbp1440 - No

References

How SecUtils Interprets This CVE

SecUtils normalizes and enriches National Vulnerability Database (NVD) records by standardizing vendor and product identifiers, aggregating vulnerability metadata from both NVD and MITRE sources, and providing structured context for security teams. For canon's affected products, we extract Common Platform Enumeration (CPE) data, Common Weakness Enumeration (CWE) classifications, CVSS severity metrics, and reference data to enable rapid vulnerability prioritization and asset correlation. This record contains no exploit code, proof-of-concept instructions, or attack methodologies—only defensive intelligence necessary for patch management, risk assessment, and security operations.