Canon Printers Multiple Vulnerabilities (CP2026-001)

# SPDX-FileCopyrightText: 2026 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

if( description )
{
  script_oid("1.3.6.1.4.1.25623.1.0.125674");
  script_version("2026-01-28T05:49:43+0000");
  script_tag(name:"last_modification", value:"2026-01-28 05:49:43 +0000 (Wed, 28 Jan 2026)");
  script_tag(name:"creation_date", value:"2026-01-26 15:16:20 +0000 (Mon, 26 Jan 2026)");
  script_tag(name:"cvss_base", value:"10.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:C/I:C/A:C");

  script_cve_id("CVE-2025-14231", "CVE-2025-14232", "CVE-2025-14233", "CVE-2025-14234",
                "CVE-2025-14235", "CVE-2025-14237");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Canon Printers Multiple Vulnerabilities (CP2026-001)");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2026 Greenbone AG");
  script_family("General");
  script_dependencies("gb_canon_printer_consolidation.nasl");
  script_mandatory_keys("canon/printer/detected");

  script_tag(name:"summary", value:"Multiple vulnerabilities have been identified for certain Canon
  Small Office Multifunction Printers and Laser Printers.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"The following vulnerabilities exist:

  - CVE-2025-14231: Buffer overflow in print job processing by WSD

  - CVE-2025-14232: Buffer overflow in XML processing of XPS file

  - CVE-2025-14233: Invalid free in CPCA file deletion processing

  - CVE-2025-14234: Buffer overflow in CPCA list processing

  - CVE-2025-14235: Buffer overflow in XPS font fpgm data processing

  - CVE-2025-14237: Buffer overflow in XPS font parse processing.");

  script_tag(name:"affected", value:"Multiple Canon printers having firmware version 06.02 and
  prior.");

  script_tag(name:"solution", value:"Update to version 07.01 or later.");

  script_xref(name:"URL", value:"https://psirt.canon/advisory-information/cp2026-001/");
  script_xref(name:"URL", value:"https://canon.a.bigcontent.io/v1/static/cp2026-001_affected_models_20251230_30ed178db85d45238b2293d375781c00");
  script_xref(name:"URL", value:"https://www.cve.org/CVERecord?id=CVE-2025-14231");
  script_xref(name:"URL", value:"https://www.cve.org/CVERecord?id=CVE-2025-14232");
  script_xref(name:"URL", value:"https://www.cve.org/CVERecord?id=CVE-2025-14233");
  script_xref(name:"URL", value:"https://www.cve.org/CVERecord?id=CVE-2025-14234");
  script_xref(name:"URL", value:"https://www.cve.org/CVERecord?id=CVE-2025-14235");
  script_xref(name:"URL", value:"https://www.cve.org/CVERecord?id=CVE-2025-14237");
  script_xref(name:"URL", value:"https://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Regarding-Remediation-Measure-Against-Potential-Buffer-Overflow-Vulnerability-in-Laser-Printers-and-Small-Office-Multifunctional-Printers");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

# nb: Added models with and without i-SENSYS as i-SENSYS seems to be only a branding name
cpe_list = make_list("cpe:/o:canon:lbp233dw_firmware",
                     "cpe:/o:canon:lbp236dw_firmware",
                     "cpe:/o:canon:lbp237dw_firmware",
                     "cpe:/o:canon:lbp631cw_firmware",
                     "cpe:/o:canon:lbp632cdw_firmware",
                     "cpe:/o:canon:lbp633cdw_firmware",
                     "cpe:/o:canon:mf451dw_firmware",
                     "cpe:/o:canon:mf452dw_firmware",
                     "cpe:/o:canon:mf453dw_firmware",
                     "cpe:/o:canon:mf455dw_firmware",
                     "cpe:/o:canon:mf552dw_firmware",
                     "cpe:/o:canon:mf553dw_firmware",
                     "cpe:/o:canon:mf651cw_firmware",
                     "cpe:/o:canon:mf652cw_firmware",
                     "cpe:/o:canon:mf653cdw_firmware",
                     "cpe:/o:canon:mf654cdw_firmware",
                     "cpe:/o:canon:mf655cdw_firmware",
                     "cpe:/o:canon:mf656cdw_firmware",
                     "cpe:/o:canon:mf657cdw_firmware",
                     "cpe:/o:canon:imagerunner_1643i_ii_firmware",
                     "cpe:/o:canon:imagerunner_1643if_ii_firmware",
                     "cpe:/o:canon:i-sensys_mf451dw_firmware",
                     "cpe:/o:canon:i-sensys_mf452dw_firmware",
                     "cpe:/o:canon:i-sensys_mf453dw_firmware",
                     "cpe:/o:canon:i-sensys_mf455dw_firmware",
                     "cpe:/o:canon:i-sensys_mf552dw_firmware",
                     "cpe:/o:canon:i-sensys_mf553dw_firmware",
                     "cpe:/o:canon:i-sensys_mf651cw_firmware",
                     "cpe:/o:canon:i-sensys_mf652cw_firmware",
                     "cpe:/o:canon:i-sensys_mf653cdw_firmware",
                     "cpe:/o:canon:i-sensys_mf654cdw_firmware",
                     "cpe:/o:canon:i-sensys_mf655cdw_firmware",
                     "cpe:/o:canon:i-sensys_mf656cdw_firmware",
                     "cpe:/o:canon:i-sensys_mf657cdw_firmware",
                     "cpe:/o:canon:i-sensys_lbp233dw_firmware",
                     "cpe:/o:canon:i-sensys_lbp236dw_firmware",
                     "cpe:/o:canon:i-sensys_lbp237dw_firmware",
                     "cpe:/o:canon:i-sensys_lbp631cw_firmware",
                     "cpe:/o:canon:i-sensys_lbp632cdw_firmware",
                     "cpe:/o:canon:i-sensys_lbp633cdw_firmware",
                     "cpe:/o:canon:i-sensys_x_1238i_ii_firmware",
                     "cpe:/o:canon:i-sensys_x_1238if_ii_firmware",
                     "cpe:/o:canon:i-sensys_x_1238p_ii_firmware",
                     "cpe:/o:canon:i-sensys_x_1238pr_ii_firmware");

if (!infos = get_app_port_from_list(cpe_list: cpe_list, first_cpe_only: TRUE))
  exit(0);

cpe = infos["cpe"];

if (!version = get_app_version(cpe: cpe, nofork: TRUE))
  exit(0);

if (version_is_less_equal(version: version, test_version: "06.02")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "07.01");
  security_message(port: 0, data: report);
  exit(0);
}

exit(99);