CVE-2021-20877

moderate-risk

Published 2022-02-08

Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, MF4890dw, MF269dw/MF265dw/MF264dw/MF262dw, MF249dw/MF245dw/MF244dw/MF242dw/MF232w, and MF229dw/MF224dw/MF222dw sold in Japan, imageCLASS MF Series (MF113W/MF212W/MF217W/MF227DW/MF229DW, MF232W/MF244DW/MF247DW/MF249DW, MF264DW/MF267DW/MF269DW/MF269DW VP, and MF4570DN/MF4570DW/MF4770N/MF4880DW/MF4890DW) and imageCLASS LBP Series (LBP113W/LBP151DW/LBP162DW ) sold in the US, and iSENSYS (LBP162DW, LBP113W, LBP151DW, MF269dw, MF267dw, MF264dw, MF113w, MF249dw, MF247dw, MF244dw, MF237w, MF232w, MF229dw, MF217w, MF212w, MF4780w, and MF4890dw) and imageRUNNER (2206IF, 2204N, and 2204F) sold in Europe) allows remote attackers to inject an arbitrary script via unspecified vectors.

Do I need to act?

0.29% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.8/10 Medium

NETWORK / LOW complexity

Affected Products (20)

2204F

2204N

2206If

Lbp113W

Lbp151Dw

Lbp162

Lbp162Dw

Lbp162L

Mf113W

Mf212W

Mf217W

Mf222Dw

Mf224Dw

Mf227Dw

Mf229Dw

Mf232W

Mf237W

Mf242Dw

Mf244Dw

Mf245Dw

Affected Vendors

Canon

References (10)

Vendor Advisory https://cweb.canon.jp/e-support/info/211221xss.html

Third Party Advisory https://jvn.jp/en/jp/JVN64806328/index.html

Third Party Advisory https://jvn.jp/jp/JVN64806328/index.html

Vendor Advisory https://www.canon-europe.com/support/product-security-latest-news/

Vendor Advisory https://www.usa.canon.com/internet/portal/us/home/support/product-advisories/det...

Vendor Advisory https://cweb.canon.jp/e-support/info/211221xss.html

Third Party Advisory https://jvn.jp/en/jp/JVN64806328/index.html

Third Party Advisory https://jvn.jp/jp/JVN64806328/index.html

Vendor Advisory https://www.canon-europe.com/support/product-security-latest-news/

Vendor Advisory https://www.usa.canon.com/internet/portal/us/home/support/product-advisories/det...

/ 100

moderate-risk

Severity 19/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 23/34 · High