Back to KEVs

CVE-2021-38154

Certain Canon devices manufactured in 2012 through 2020 (such as imageRUNNER ADVANCE iR-ADV C5250), when Catwalk Server is enabled for HTTP access,...

Basic Information

CVE State
PUBLISHED
Reserved Date
August 06, 2021
Published Date
August 29, 2021
Last Updated
August 04, 2024
Vendor
Canon
Product
imageRUNNER ADVANCE iR-ADV C5250
Description
Certain Canon devices manufactured in 2012 through 2020 (such as imageRUNNER ADVANCE iR-ADV C5250), when Catwalk Server is enabled for HTTP access, allow remote attackers to modify an e-mail address setting, and thus cause the device to send sensitive information through e-mail to the attacker. For example, an incoming FAX may be sent through e-mail to the attacker. This occurs when a PIN is not required for General User Mode, as exploited in the wild in August 2021.
Tags
nuclei_scanner

CVSS Scores

CVSS v3.1

7.5 - HIGH

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

4.3

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploit Status

Exploited in the Wild
Yes (2021-08-29 04:59:18 UTC) Source

References

https://www.usa.canon.com/internet/portal/us/home/support/product-advisories https://protocolpolice.nl/CVE-2021-38154_Protocol_Police_Catwalk_Alert

Known Exploited Vulnerability Information

Source Added Date
CVE 2021-08-29 04:59:18 UTC

Scanner Integrations

Scanner URL Date Detected
Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38154.yaml 2026-06-01 15:34:31 UTC

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel

  • Detected by Nuclei