CVE-2024-12648CWE-787

Buffer overflow in TIFF data EXIF tag processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network…

Critical · published January 28, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
67.4
In the wild
Unconfirmed
What it is

🔥 A buffer overflow lurking in the TIFF data processing of certain printers could leave them unresponsive—or worse, allow attackers to execute arbitrary code! Think of this like a crowded subway train where someone shoves a giant suitcase into a small doorway, causing chaos and blocking everyone behind. If the printer isn't properly checking the size of the input, it can lead to a complete breakdown! An attacker on the same network segment could exploit this vulnerability to crash the printer or, in a more sinister turn, gain control to execute malicious commands. This could disrupt office operations and potentially expose sensitive data stored on the device, making it a serious threat!

Put simply

Think of this like a crowded subway train where someone shoves a giant suitcase into a small doorway, causing chaos and blocking everyone behind. If the printer isn't properly checking the size of the input, it can lead to a complete breakdown! This vulnerability arises from insufficient validation of TIFF data in the EXIF tag processing, leading to a buffer overflow that compromises the printer's functionality and security.

What to do

An attacker on the same network segment could exploit this vulnerability to crash the printer or, in a more sinister turn, gain control to execute malicious commands. This could disrupt office operations and potentially expose sensitive data stored on the device, making it a serious threat! To safeguard your devices, update to the latest firmware version that addresses this vulnerability. For affected models, ensure that you have patched to version 05.05 or later. Regularly audit your printer's network security settings to limit exposure to potential attackers. You've got this! Secure your printers and keep your network safe! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01177 · 67.4th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2025-01-28T00:39Z
EPSS history
Timeline
  • 28 JAN 00:39Z
    Buffer overflow in TIFF data EXIF tag processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network…
    cvelistv5