CVE-2025-2146 is a critical buffer overflow (CVSS 9.8) in the WebService authentication processing of many Canon small office multifunction printers and laser printers, firmware v05.07 and earlier. It can crash the device or allow code execution. Check Canon's advisory CP2025-001 for the fixed firmware.
What's affected
- Products: Canon small office multifunction printers and laser printers sold in Japan, the US and Europe (Satera, imageCLASS and i-SENSYS lines, plus some imageRUNNER and imageCLASS X models)
- Affected firmware: v05.07 and earlier
- Fixed firmware: not stated in the record. Canon's advisory CP2025-001 is the place to confirm it; I could not load that page from here
- CVSS: 9.8 (Critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Published: 2025-05-26
The record lists dozens of models. Examples include the MF656Cdw, MF654Cdw, MF455dw and LBP633Cdw families under different regional names, so check the full list in Canon's advisory for your exact model. The record describes an attacker on the network segment. The CISA Known Exploited Vulnerabilities flag is false for this CVE, and none of the pages I read report active exploitation.
How to check if you're exposed
Printers are easy to forget, so start by finding them.
- List printers from your asset inventory or a network scan, and note the model and the regional name on the device.
- Open the printer's remote user interface or its control panel and read the firmware version.
- Compare it with v05.07. Version v05.07 or earlier on a listed model is affected.
- Read Canon's advisory for the fixed firmware version and the update instructions for your region.
A quick sanity check for exposure is to see whether the printer's web interface or WebService port answers from outside its own network segment. A printer on a guest network or on the internet is the highest risk. A free in-browser dependency scan does not cover device firmware.
What to do now
- Build a list of Canon printers and multifunction devices with model and firmware version.
- Read Canon's advisory CP2025-001 and apply the fixed firmware to every affected unit.
- Move printers off networks that untrusted devices can reach, and block access to them from the internet.
- Turn off the WebService function if you do not use it and Canon's advisory allows it.
- Add printers to your regular patch cycle so the next firmware notice does not depend on someone remembering.
Why it matters
The weakness is CWE-787, out of bounds write. During authentication processing in the WebService function, input is copied into a buffer that is too small. The record says the result can be an unresponsive device or execution of arbitrary code.
Printers are a long standing blind spot. They hold network credentials, scan documents and sit on the same network as everything else, yet they rarely appear in patch reports. The vector shows no privileges and no user interaction, which is why the score is 9.8, though the attacker needs to be on the network segment the record describes. Keep printers on their own segment and put them on the patch list.
Quick check
Which firmware fixes it?
The record only says v05.07 and earlier are affected. Canon's advisory CP2025-001 gives the fixed firmware and update steps.
Can an attacker on the internet reach it?
The record describes an attacker on the network segment. Keeping printers off the internet and on a separate segment is still the right control.
Sources
Last reviewed: 19 October 2026.
