Lucene search

[email protected]NVD:CVE-2021-38085

HistoryAug 11, 2021 - 6:15 p.m.

CVE-2021-38085

2021-08-1118:15:07

CWE-732

[email protected]

web.nvd.nist.gov

canon

tr150

print driver

privilege escalation

cnmurge.dll

printisolationhost

system process

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

21.0%

JSON

The Canon TR150 print driver through 3.71.2.10 is vulnerable to a privilege escalation issue. During the add printer process, a local attacker can overwrite CNMurGE.dll and, if timed properly, the overwritten DLL will be loaded into a SYSTEM process resulting in escalation of privileges. This occurs because the driver drops a world-writable DLL into a CanonBJ %PROGRAMDATA% location that gets loaded by printisolationhost (a system process).

Affected configurations

Nvd

Node

canonpixma_tr150_firmwareRange≤3.71.2.10

AND

canonpixma_tr150Match-

VendorProductVersionCPE
canonpixma_tr150_firmware*cpe:2.3:o:canon:pixma_tr150_firmware:*:*:*:*:*:*:*:*
canonpixma_tr150-cpe:2.3:h:canon:pixma_tr150:-:*:*:*:*:*:*:*