Canon has recently fixed some long-known vulnerabilities in its own printers via a patch. Printers still appear to be an attack surface that is too easily overlooked.
Canon has recently patched seven critical vulnerabilities in its multifunction and laser printers. The vulnerabilities came to light back in the summer of 2023 during the Pwn2Own SOHO Smashup in Toronto, Canada.
The vulnerabilities (CVE-2023-6229 through CVE-2023-6234 and CVE-2024-0244) are related to various processes in all Canon printers. Examples include exploits of the username and password processes for authenticating mobile devices or the Service Location Protocol (SLP) attribute request.
These exploits allowed unauthenticated hackers, among other things, to remotely launch DDoS attacks or to run code on printers connected to the Internet. In addition, hackers could also use these printers to penetrate deeper into victims’ systems and networks.
Advice from Canon
According to Canon, no active exploits of the vulnerabilities have been found at this time, but customers should proactively scan for indications that systems have been compromised, especially since the vulnerabilities have not been patched for months.
The printer manufacturer also advises customers to set private IP addresses for the products and set up a network environment with a firewall or router that can restrict network access.
Printers still major attack vector
The discovery of the vulnerabilities in these printers used mainly by SMEs and self-employed workers shows, according to Darkreading, that printers are still often forgotten about as an attack vector for hackers.
Printers are used everywhere, making them potentially extremely attractive to hackers. They can be used for malicious intentions such as lateral movement in a network.
Companies should therefore implement network segmentation to reduce this attack surface. A simpler solution is to simply patch printers more often, although this requires the manufacturer to make patches available on time.
Also read: Canon machines to become low-cost ASML alternative
16 hours ago
