JVN#64806328: Canon laser printers and small office multifunctional printers vulnerable to cross-site scripting

Multiple Canon laser printers and small office multifunctional printers contain a stored cross-site scripting vulnerability (CWE-79).

Impact

An arbitrary script may be executed on the web browser of the user who is accessing the product settings screen.

Solution

Update the firmware
Update the firmware to the latest version according to the information provided by the developer.

Products Affected

A wide range of the products is affected.
For more information, refer to the following information provided by the developer.

• Canon USA: Canon Laser Printer and Small Office Multifunctional Printer related to cross-site scripting
• Canon Europe: Cross-site scripting vulnerability for laser printers and multifunction devices for small offices – 11 January 2022