CVE-2018-12048

A remote attacker can bypass the Management Mode on the Canon LBP7110Cw web interface without a PIN for /checkLogin.cgi via vectors involving /portal_top.html…

published June 8, 2018

CVSS
—
EPSS
5%
Percentile
92.1
In the wild
Unconfirmed
What it is

⚠️ A crafty quirk in the Canon LBP7110Cw lets attackers waltz right past the login PIN and into the management interface! 🔓 Think of it like a guest checking into a hotel room without needing a keycard — they can access everything in the room without any verification whatsoever! This oversight could allow an attacker to manipulate settings, access sensitive documents, or even disrupt operations, making your device a playground for any unauthorized user. Imagine someone walking in and changing the printer's settings to print malicious content or draining the toner without you knowing!

Put simply

Think of it like a guest checking into a hotel room without needing a keycard — they can access everything in the room without any verification whatsoever! This vulnerability occurs because the Canon LBP7110Cw's web interface allows unauthorized access to the management mode by bypassing the PIN check when certain URLs are accessed, like /checkLogin.cgi and /portal_top.html.

What to do

This oversight could allow an attacker to manipulate settings, access sensitive documents, or even disrupt operations, making your device a playground for any unauthorized user. Imagine someone walking in and changing the printer's settings to print malicious content or draining the toner without you knowing! To secure your Canon device, change the default settings immediately and implement the recommended countermeasures from the documentation. Regularly audit your device's configurations and ensure that no factory defaults are left unchanged. 🔒 You've got this! Follow these steps and keep your Canon LBP7110Cw safe from unauthorized access! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04936 · 92.1th percentile
Published
2018-06-08T01:00Z
EPSS history
Timeline
  • 08 JUN 01:00Z
    A remote attacker can bypass the Management Mode on the Canon LBP7110Cw web interface without a PIN for /checkLogin.cgi via vectors involving /portal_top.html…
    cvelistv5