The vulnerability of Canon’s microprogrammed software for printers stems from deficiencies in authentication procedures, allowing attackers to gain access to the device’s web interface with administrator privileges.

The vulnerability of Canon printer’s microprogramming software is related to deficiencies in the authentication process when using standard device settings. Exploiting this vulnerability can allow a malicious actor to gain access to the device’s web interface with administrator privileges...

HPSBHF03589 rev. 5 - HP Ink Printers Remote Code Execution

Potential Security Impact Reported by: TBA VULNERABILITY SUMMARY Two security vulnerabilities have been identified with certain HP Inkjet printers. A maliciously crafted file sent to an affected device can cause a stack or static buffer overflow, which could allow remote code execution. RESOLUTIO...

Active Directory Reconnaissance: ADRecon

ADRecon is a tool which extracts various artifacts as highlighted below out of an AD environment in a specially formatted Microsoft Excel report that includes summary views with metrics to facilitate analysis. The report can provide a holistic picture of the current state of the target AD...

HPSBPI03583 rev. 1 - ROCA - Vulnerable RSA Generation: HP Trusted Platform Module (TPM) Accessory and Certain HP Enterprise Printer and MFP Products, Certain HP PageWide Printer and MFP Products with Standard TPM

Potential Security Impact Remote disclosure of information VULNERABILITY SUMMARY A potential security vulnerability known as “ROCA: Vulnerable RSA Generation” has been identified with the RSA keys generated by the HP Trusted Platform Module TPM Accessory and printers equipped with a TPM. This...

ROCA - Vulnerable RSA Generation: HP Trusted Platform Module (TPM) Accessory and Certain HP Enterprise Printer and MFP Products, Certain HP PageWide Printer and MFP Products with Standard TPM

A potential security vulnerability known as “ROCA: Vulnerable RSA Generation” has been identified with the RSA keys generated by the HP Trusted Platform Module TPM Accessory and printers equipped with a TPM. This vulnerability could potentially be exploited remotely to allow remote disclosure of...

Canon LBP6650/LBP3370/LBP3460/LBP7750C - Authenticaton Bypass(CVE-2018-11692)

Description : An issue was discovered on Canon LBP6650, LBP3370, LBP3460, LBP7750C printers. It is possible for a remote unauthenticated attacker to bypass the Administrator Mode authentication without a password at any URL of the device that requires authentication. PoC : Start searching for Can...

Authentication Bypass Vulnerability in Multiple Canon Products

Canon LBP6650 and others are printer devices from Canon Japan. A security vulnerability exists in several Canon products. The vulnerability can be exploited by an attacker to bypass the administrator mode authentication of the /tlogin.cgi file...

Canon LBP6650/LBP3370/LBP3460/LBP7750C - Authenticaton Bypass

Canon LBP6650/LBP3370/LBP3460/LBP7750C - Authenticaton Bypass. CVE-2018-11692. Webapps exploit for Hardware platform Exploit Title: Incorrect Access Control in Canon LBP6650, LBP3370, LBP3460, LBP7750C Date: 3.6.2018 Exploit Author: Huy Kha Vendor Homepage: http://global.canon.com Software Link:...

Canon MF210 / MF220 Authentication Bypass

Exploit Title: Incorrect Access Control in Canon MF210 & MF220 Series Date: 4.6.2018 Exploit Author: Huy Kha Vendor Homepage: http://global.canon.com Software Link: Website Version: MF210 & MF20 Series Severity: High Tested on: Mozilla FireFox Description : An issue was discovered on Canon MF210 ...

Brother Printers Detection (HTTP)

HTTP based detection of Brother printer devices. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Canon Printers Authentication Bypass Vulnerability (Jul 2018)

Canon Printers LBP6650, LBP3370, LBP3460 and LBP7550C are prone to an authentication bypass vulnerability. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CVE-2018-11692

An issue was discovered on Canon LBP6650, LBP3370, LBP3460, and LBP7750C devices. It is possible to bypass the Administrator Mode authentication for /tlogin.cgi via vectors involving frame.cgi?page=DevStatus. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the...

CVE-2018-11692

An issue was discovered on Canon LBP6650, LBP3370, LBP3460, and LBP7750C devices. It is possible to bypass the Administrator Mode authentication for /tlogin.cgi via vectors involving frame.cgi?page=DevStatus. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the...

Brother HL Series Printers 1.15 - Cross-Site Scripting

Exploit Title: XSS at Brother HL series printers Date: 30.05.2018 Exploit Author: Huy Kha Vendor Homepage: http://support.brother.com Software Link: Website Version: Brother HL series printers. Tested on: Mozilla FireFox Reflected XSS Payload : "--!" Description : Starting searching for printers...

CVE-2018-11581

Cross-site scripting XSS vulnerability on Brother HL series printers allows remote attackers to inject arbitrary web script or HTML via the url parameter to etc/loginerror.html...

CVE-2018-11581

Cross-site scripting XSS vulnerability on Brother HL series printers allows remote attackers to inject arbitrary web script or HTML via the url parameter to etc/loginerror.html...

CVE-2018-11581

Mode C: CVE-2018-11581 affects Brother HL series printers, with a cross-site scripting (XSS) flaw exploitable via the url parameter to etc/loginerror.html. The root cause is an unsanitized input reflected in the printer’s web UI, enabling injection of arbitrary script/HTML. Multiple connected sou...

Microsoft Windows 10: Create permanent shared objects

This user right determines which accounts can be used by processes to create a directory object by using the object manager. Directory objects include Active Directory objects, files and folders, printers, registry keys, processes, and threads. Users who have this capability can create permanent...

[SECURITY] Fedora 26 Update: glpi-9.1.7.1-2.fc26

GLPI is the Information Resource-Manager with an additional Administration- Interface. You can use it to build up a database with an inventory for your company computer, software, printers.... It has enhanced functions to make the daily life for the administrators easier, like a job-tracking-syst...

HPSBPI03580 rev. 2 - Cross Site Request Forgery Vulnerability for Certain HP Enterprise and PageWide Printers

Potential Security Impact Elevation of Privilege. Reported by: Mohamed Abdelbaset Elnoby VULNERABILITY SUMMARY A potential security vulnerability has been identified with certain HP Enterprise and PageWide printers and MFPs. This vulnerability is known as Cross Site Request Forgery and could...