Critical Remote Code Execution in Canon imageCLASS MF654Cdw (CVE‑2025‑14233) Threatens Network‑Adjacent Printers
What It Is – A memory‑corruption flaw in the BJNP service of Canon’s imageCLASS MF654Cdw multi‑function printer enables unauthenticated attackers on the same network segment to execute arbitrary code with device‑level privileges.
Exploitability – The vulnerability is actively exploitable; proof‑of‑concept code was demonstrated at the Pwn2Own competition. CVSS 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a high likelihood of remote code execution without user interaction.
Affected Products – Canon imageCLASS MF654Cdw (all firmware versions prior to the March 2026 security update).
TPRM Impact –
- Printers sit on corporate LANs and often have access to internal document repositories, making them a foothold for lateral movement.
- Compromise can lead to data exfiltration, credential theft, or deployment of ransomware across the organization’s network.
- Third‑party risk assessments that treat printers as “low‑risk” peripherals must be revisited.
Recommended Actions –
- Verify that the latest firmware patch from Canon (released 2026‑03‑23) is applied to every MF654Cdw unit.
- If patching cannot be performed immediately, isolate the devices on a segmented VLAN with strict outbound firewall rules.
- Disable any unnecessary network services on the printer (e.g., BJNP, FTP, SMB).
- Incorporate printer firmware version checks into your continuous asset‑inventory tooling.
- Update third‑party risk questionnaires to include printer firmware management and network segmentation controls.