TL;DR

Remote code execution vulnerability in Canon imageCLASS MF654Cdw printer, allowing unauthenticated attackers to exploit TTF parsing flaw for arbitrary code execution.

What happened

Vulnerability discovered in Canon imageCLASS MF654Cdw printer's TrueType Font (TTF) parser

Why it matters for ops

Exploitation allows remote, network-adjacent attackers to execute arbitrary code without authentication Potential for sensitive data exposure and control of the device

Mitigation

  • Update firmware to latest version addressing CVE-2025-14235
  • Isolate affected devices from direct network access
  • Monitor for unauthorized network communications with printers

Action items

  • Apply Canon's official patch or workaround immediately
  • Review network segmentation policies for printer infrastructure
  • Conduct security audit on print server and client systems

Detection IOCs

  • Unusual TTF font file processing activity on printer network interface
  • Unexpected remote connections to printer ports

Source link

http://www.zerodayinitiative.com/advisories/ZDI-26-206/