CVE-2023-6231 is a Critical severity (CVSS 9.8) buffer overflow in the WSD probe request process of certain Canon office multifunction and laser printers running firmware v03.07 or earlier. A network neighbour could crash the device or run code on it. Update to the firmware Canon lists in advisory CP2024-001.
What's affected
Canon's advisory (CP2024-001) covers office multifunction printers and laser printers. The NVD record lists the affected product lines and firmware by region.
- Japan: Satera LBP670C Series and Satera MF750C Series, firmware v03.07 and earlier.
- United States: Color imageCLASS LBP674C, Color imageCLASS X LBP1333C, Color imageCLASS MF750C Series and Color imageCLASS X MF1333C Series, firmware v03.07 and earlier.
- Europe: i-SENSYS LBP673Cdw, C1333P, i-SENSYS MF750C Series and C1333i Series, firmware v03.07 and earlier.
- Fixed: the record gives no fixed version number. Canon's advisory pages were not retrievable when I fetched them, so take the fixed firmware version from the Canon page for your region.
- Severity: CVSS 9.8 Critical. The attacker is described as being on the network segment, which is the same segment or network that can reach the printer.
How to check if you're exposed
Printers rarely show up in software inventories, so start with an inventory of your own.
- List every Canon printer and multifunction device by model name and location. The model names above are the ones in scope.
- Read the firmware version from the device's own status or settings pages, or from the web interface if it is enabled. Anything at v03.07 or earlier is in range.
- Note which network segment each printer sits on and which hosts can reach it.
A network scan from a trusted host can help find printers you forgot about, but run it under your normal change process. Do not probe printers outside your own network.
What to do now
- Download the fixed firmware for your model and region from Canon and apply it. Use the Canon support page for your country, linked from CP2024-001.
- Until you can update, keep the printers off the internet. Read the advisory for any device specific mitigation steps.
- Put printers on their own VLAN and allow only print servers and approved clients to reach them.
- Turn off services you do not use on the device, such as network discovery protocols, once you have confirmed nothing depends on them.
- Add printers and other embedded devices to the asset inventory with owner, location and firmware version, and set a review date.
Why it matters
This entry covers the WSD probe request process. WSD stands for Web Services for Devices, a protocol that lets computers discover printers on a local network. The record places the overflow in the code that handles a WSD probe request. Discovery traffic is accepted without any login, so the code that parses it is reachable from the network segment by design.
The weakness is CWE-787, an out of bounds write. The device receives data of an unexpected length, copies it into a buffer that is too small, and writes past the end. On an embedded device the result can be a crash, which the advisory words as the product becoming unresponsive, or arbitrary code execution.
Printers deserve the same patching discipline as servers. They hold stored documents and address books, they sit on internal networks, and they often run for years without a firmware update. The kev flag for this record is false, and nothing I could retrieve says it is exploited in the wild. Six CVEs in this range (CVE-2023-6229 to CVE-2023-6234) point at the same Canon advisory, so plan to apply one firmware update and confirm it covers all of them.
Quick check
Is this the only Canon printer flaw I need to fix?
No. Six CVEs from CVE-2023-6229 to CVE-2023-6234 cite the same Canon advisory and firmware range, so one update should address the set. Confirm against CP2024-001.
Can an attacker on the internet reach this?
The record says the attacker is on the network segment. A printer exposed to the internet widens that, which is why removing it from the internet matters.
Sources
- Canon PSIRT advisory CP2024-001 (listed in the record, access denied when fetched)
- Canon Japan notice
- Canon USA service notice
Last reviewed: 19 October 2026.
