CVE-2022-24673: Canon imageCLASS MF644Cdw Unauthenticated SLP Buffer Overflow Remote Code Execution

CVE-2022-24673 is a critical, unauthenticated remote-code-execution flaw (CWE-787, out-of-bounds write / stack-based buffer overflow) in the SLP (Service Location Protocol) service of Canon's imageCLASS MF644Cdw printer firmware: an attacker who can reach the device over the network can send specially crafted data that overflows a fixed-length stack buffer, letting them run arbitrary code with root privileges without needing credentials, and NVD has published its own Primary CVSS v3.1 score of 9.8 (critical) for the flaw.

CVE-2022-24673 (CWE-787, out-of-bounds write) affects Canon's imageCLASS MF644Cdw laser multifunction printer. NVD's description states: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the SLP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root" (NVD).

NVD lists its own Primary CVSS v3.1 base score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — a plain network attack vector. That differs from the Secondary score Trend Micro's Zero Day Initiative (ZDI) submitted for the same flaw: CVSS v3.0 8.8 (high), vector CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which rates the attack vector as adjacent-network rather than network. NVD's own CWE classification (CWE-787) also differs slightly from ZDI's submitted CWE-121 (stack-based buffer overflow, a more specific child weakness of CWE-787) (NVD).

ZDI's advisory ZDI-22-515 attributes the discovery to Angelboy (@scwuaptx) of the DEVCORE Research Team, records that the flaw was reported to Canon on January 21, 2022, and that the coordinated public advisory was released March 18, 2022 — about a year before NVD's own record was published (ZDI-22-515).

This flaw was disclosed alongside three closely related, unauthenticated remote-code-execution bugs reported by different researchers against the same MF644Cdw firmware build: CVE-2022-24672 (CADM service, heap-based buffer overflow, NVD Primary CVSS 8.8), CVE-2022-24674 (Privet API, stack-based buffer overflow, NVD Primary CVSS 8.8), and CVE-2022-43608 (BJNP service, integer overflow leading to an undersized buffer allocation, NVD Primary CVSS 8.8, reported against firmware 10.03) — meaning the same printer model shipped with at least four independently exploitable, pre-authentication remote-code-execution paths across its network-facing services (NVD: CVE-2022-24672, CVE-2022-24674, CVE-2022-43608).

NVD's own structured platform (CPE) data for CVE-2022-24673 lists 76 distinct vulnerable firmware identifiers, extending well beyond the MF644Cdw named in the plain-English description to cover Canon's broader imageCLASS MF and LBP laser-printer lines (including MF4xx/6xx/7xx/8xx/1xx series and LBP2xx/6xx series models), the WG7250 WorkForce series, and the imageRUNNER 1435/1643 and D16xx-series MFPs — indicating the vulnerable SLP code is shared much more widely across Canon's small-office laser printer and MFP firmware than the CVE title alone suggests (NVD).

Canon's own product advisory for this flaw, referenced by both NVD and ZDI, documents the vendor's firmware update addressing the issue; printer and MFP administrators running an affected Canon imageCLASS model should apply Canon's current firmware and, until confirmed patched, avoid exposing the device's network services directly to untrusted networks (Canon product advisories (referenced by NVD)).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.0119 (68.2nd percentile) as of 2026-11-07 — a critical, network-exploitable RCE with a confirmed NVD score but no reported in-the-wild exploitation to date (CISA KEV, FIRST EPSS).

• Unauthenticated remote attackers can execute arbitrary code as root on Canon imageCLASS MF644Cdw 10.02 printers via a stack-based buffer overflow in the SLP protocol implementation, due to missing length validation of user-supplied data before copying it into a fixed-length stack buffer. — NVD
• NVD Primary CVSS v3.1 base score 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-787; differs from ZDI's Secondary CVSS v3.0 8.8 (AV:A) and CWE-121 submission. — NVD
• ZDI-22-515 credits Angelboy (@scwuaptx) of DEVCORE Research Team; vulnerability reported to Canon January 21, 2022; coordinated public advisory released March 18, 2022. — ZDI-22-515
• Three companion unauthenticated RCE flaws in the same MF644Cdw firmware build were disclosed in the same bundle: CVE-2022-24672 (CADM service), CVE-2022-24674 (Privet API), and CVE-2022-43608 (BJNP service, firmware 10.03), each with its own NVD Primary CVSS of 8.8. — NVD
• NVD's CPE configuration data for CVE-2022-24673 lists 76 vulnerable firmware identifiers spanning Canon's imageCLASS MF and LBP laser-printer lines, the WG7250 WorkForce series, and the imageRUNNER 1435/1643/D16xx-series MFPs. — NVD
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.0119 (68.2nd percentile) as of 2026-11-07. — FIRST EPSS