Canon MF753Cdw printers were affected by CVE-2024-0244, a memory flaw that could be triggered without a login. A successful attacker on a network that could reach the printer could run code on the device, while simpler malformed input could crash and reboot it.
Changing the destination fax-number length to 0xff caused the fax task to crash and the printer to reboot. Ford later showed that a crafted payload could fully control a pointer passed to the printer's free() memory-management function.
The demonstration retrieved an image from the attacking computer and wrote it directly to the printer's display. The researcher said an earlier exploitation route worked but was too unreliable for the competition.
The exact root cause of the overflow was not identified in the research. Ford's analysis was that an unchecked fax-number length overflowed a heap object—a block of working memory—and corrupted a pointer later handed to free().
What owners should do
The published research covers the MF753Cdw and says the techniques may not apply directly to newer devices. It does not establish that every Canon printer is affected.- Confirm whether your printer is a Canon MF753Cdw, then obtain available firmware updates from Canon's official support page.
- Keep printer access limited to trusted home or office networks; the demonstrated attack did not require authentication.
- Investigate unexplained printer reboots, especially if the device received an unexpected fax or print request.
Malformed fax data exposed the flaw
Security researcher Connor Ford, writing for www.thezdi.com, found that the Windows fax driver sent SOAP messages and a binary fax payload to the printer's /wsd/print endpoint. SOAP is a structured format applications use to exchange messages.Changing the destination fax-number length to 0xff caused the fax task to crash and the printer to reboot. Ford later showed that a crafted payload could fully control a pointer passed to the printer's free() memory-management function.
Researcher demonstrated code execution
Ford combined the fax flaw with BJNP, Canon's proprietary device-discovery and printing protocol. Because unauthenticated clients could send BJNP requests and place chosen data at predictable memory addresses, he used it to store and execute code on the printer.The demonstration retrieved an image from the attacking computer and wrote it directly to the printer's display. The researcher said an earlier exploitation route worked but was too unreliable for the competition.
The exact root cause of the overflow was not identified in the research. Ford's analysis was that an unchecked fax-number length overflowed a heap object—a block of working memory—and corrupted a pointer later handed to free().
