CVE-2024-0244 – Unauthenticated Heap Buffer Overflow in Canon MF753Cdw Printer (Fax Job Handling, /wsd/print)

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5751 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2024-0244 Canon MFP — Printer-Originated Internet Egress (Shellcode Payload Fetch / C2)

Detects Canon printers initiating connections to non-private destinations. The Pwn2Own shellcode for CVE-2024-0244 fetched an image from a remote machine over the network (ingress tool transfer), and any post-exploitation implant on the MFP would call out over HTTP(S). Printers normally only answer print/scan requests and talk to a few internal services.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1105, T1071, T1071.001
• Data sources: zeek:conn (index=zeek) + tl_printer_assets lookup, NGFW flow logs (CommonSecurityLog) + PrinterAssets watchlist
• Severity: high
• Confidence: medium

Splunk SPL

index=zeek sourcetype="bro:conn:json" earliest=-24h
| rename id.orig_h AS src_ip, id.resp_h AS dest_ip, id.resp_p AS dest_port
| lookup tl_printer_assets ip AS src_ip OUTPUT asset_role model
| where asset_role="printer"
| where NOT (cidrmatch("10.0.0.0/8",dest_ip) OR cidrmatch("172.16.0.0/12",dest_ip) OR cidrmatch("192.168.0.0/16",dest_ip) OR cidrmatch("169.254.0.0/16",dest_ip))
| stats count AS conns dc(dest_ip) AS dests values(dest_port) AS ports sum(orig_bytes) AS bytes_out sum(resp_bytes) AS bytes_in BY src_ip, model, dest_ip
| eval cve="CVE-2024-0244", note="Printer egress to non-private host: possible payload fetch or C2 callback"
| table src_ip model dest_ip ports conns bytes_out bytes_in cve note

Microsoft KQL

let Printers = _GetWatchlist('PrinterAssets') | project SourceIP = tostring(IPAddress), Model;
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where not(ipv4_is_private(DestinationIP))
| join kind=inner Printers on SourceIP
| summarize Conns=count(), Ports=make_set(DestinationPort), BytesOut=sum(SentBytes), BytesIn=sum(ReceivedBytes) by SourceIP, Model, DestinationIP
| project SourceIP, Model, DestinationIP, Ports, Conns, BytesOut, BytesIn

Sigma

title: Canon Printer Outbound Web Connection to Non-Private Address
id: 7b1e5c52-3a0d-4f0e-9a51-575100000003
status: experimental
description: Detects a printer-VLAN host initiating web connections to non-private addresses, consistent with CVE-2024-0244 post-exploitation payload fetch or C2. The source CIDR is an example printer VLAN and must be edited per environment.
references:
    - https://www.zerodayinitiative.com/advisories/ZDI-24-095
    - https://www.thezdi.com/blog/2026/9/23/cve-2024-0244-a-heap-buffer-overflow-in-the-canon-mf753cdw-printer
author: Threadlinqs Team
date: 2026-11-11
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1105
    - cve.2024-0244
logsource:
    category: firewall
detection:
    selection:
        src_ip|cidr: '10.99.0.0/24'
        dst_port:
            - 80
            - 443
            - 8080
            - 8443
    filter_internal:
        dst_ip|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '169.254.0.0/16'
    condition: selection and not filter_internal
falsepositives:
    - Printer cloud services such as vendor firmware checks or remote-support features
    - NTP or DNS to public resolvers if not proxied
level: medium

Known false positives:

• Printer cloud services such as vendor firmware checks, ePrint or remote-support features
• NTP or DNS to public resolvers when not proxied

Tuning notes: Create the tl_printer_assets lookup (ip, asset_role, model) and the PrinterAssets Sentinel watchlist from your CMDB. The Sigma flavour uses the example printer VLAN 10.99.0.0/24 and must be edited to your printer subnets. Allowlist Canon update and cloud-service destinations.

• 🔒 CVE-2024-0244 Canon MFP — First-Seen Client Posting to [indicator] — Exploitation · unlock with TL Creds
• 🔒 CVE-2024-0244 Canon MFP — [indicator] SOAP plus BJNP From Same Source — Exploit Chain · unlock with TL Creds
• 🔒 CVE-2024-0244 Canon MFP — Printer-Originated Connections to Admin Protocols / Internal Fan-Out · unlock with TL Creds
• 🔒 CVE-2024-0244 Canon MFP — Non-Private Source Requesting [indicator] — Exploitation · unlock with TL Creds
• 🔒 Canon BJNP Ports Reachable From Non-Private Source (CVE-2024-0244 Exposure) · unlock with TL Creds
• 🔒 Canon BJNP Discovery Sweep (UDP 8611) Across Multiple Hosts — Printer Reconnaissance · unlock with TL Creds
• 🔒 CVE-2024-0244 Canon MFP Fax Job Overflow — Burst of SOAP POSTs to [indicator] — Exploitation · unlock with TL Creds
• 🔒 CVE-2024-0244 Canon BJNP Session Burst to Printer — Exploit Staging / Post-Exploitation · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-5751.

Technical analysis

CVE-2024-0244 affects the fax job handling of Canon laser and small-office multifunction printers, including the Color imageCLASS MF753Cdw (featured at Pwn2Own Toronto 2023). NVD describes it as a buffer overflow in the CPCA PCFAX number process (CWE-787) that lets an attacker on the same network segment make the device unresponsive or execute arbitrary code. NVD and Canon score it CVSS 3.1 9.8; ZDI advisory ZDI-24-095 (ZDI-CAN-22658) scores it 8.8 with an adjacent-network vector. ZDI credits Connor Ford (@ByteInsight) of Nettitude, who reported it to Canon on 2023-12-11; coordinated public release was 2024-02-06.

A ZDI blog post by Connor Ford, published 2026-09-23, gives the technical detail. The printer's fax driver sends several SOAP messages to the /wsd/print HTTP endpoint to start a fax job. One of them is the only message in the flow carrying a binary payload. That payload holds the destination fax details, the file and filename, the Windows username and machine name, and a few hundred bytes of unknown data. Most strings in it are preceded by a length byte. Setting the destination number's length byte to 0xff crashed the fax task and rebooted the printer. Instrumenting free() showed the crash was caused by a fully attacker-controlled pointer being passed to free(). The destination number is copied into a fixed-size phone_number array using the attacker-supplied length with no bounds check; the overflow reaches an adjacent pointer member that is later freed. The author did not identify the exact root-cause object.

The author's Pwn2Own exploit chain uses Canon's proprietary BJNP discovery/print protocol. Unauthenticated clients can send BJNP requests that are stored at known fixed addresses and accept arbitrary bytes in the body. BJNP buffers are used to stage a fake heap chunk and shellcode at known addresses. The arbitrary free() places the fake chunk on the free list, a legitimate allocation then lands on it, and a later BJNP session overwrites a function pointer in that object to point at the shellcode. All dynamic memory on the device is RWX. The demonstration shellcode fetched an image from a remote machine and displayed it on the printer screen (DOOM). The post notes that newer Canon devices have a few security mitigations that may make these techniques inapplicable.

The sources do not report in-the-wild exploitation (CISA SSVC: exploitation none, automatable no, technical impact total), a public weaponized PoC, IOCs or actor attribution. Canon states the issue is resolved for the affected models via firmware update; the NVD configuration covers firmware v03.07 and earlier.

MITRE ATT&CK techniques by tactic:

Command and Control

T1071 Application Layer Protocol

Initial Access

T1190 Exploit Public-Facing Application

Remediation

Patches

• Apply Canon's firmware update for affected models per Canon PSIRT advisory CP2024-001 and the Canon product security pages

Immediate actions

• Identify Canon MF750C-series / MF1333C / LBP1333C devices and confirm firmware is newer than v03.07
• Restrict access to the printer's HTTP (/wsd/print) and BJNP services to trusted print servers and admin hosts

Workarounds

• Do not expose the printer to the internet; use a private IP address behind a firewall or router
• Disable the fax function and unneeded network services where not required

Longer-term hardening

• Place printers and MFPs on a dedicated VLAN with no inbound access from user or internet segments
• Monitor printer network traffic for malformed SOAP requests to /wsd/print and unexpected device reboots

Affected and fixed versions

• Canon — Color imageCLASS MF753Cdw / MF750C Series (also i-SENSYS MF751cdw, MF753cdw, MF754Cdw, MF755cdw, Satera MF750C Series)
  Vulnerable versions: firmware v03.07 and earlier
  Fixed in: firmware newer than v03.07 (see Canon advisory)
• Canon — Color imageCLASS X MF1333C / i-SENSYS C1333iF / LBP1333C
  Vulnerable versions: firmware v03.07 and earlier
  Fixed in: firmware newer than v03.07 (see Canon advisory)

Timeline

• 2023-12-11 Connor Ford of Nettitude reports the fax job heap overflow to Canon via ZDI (ZDI-24-095 / ZDI-CAN-22658)
• 2024-02-05 Canon Japan publishes vulnerability response notice for buffer overflow in laser printers and small office MFPs
• 2024-02-06 Coordinated public release of ZDI-24-095; CVE-2024-0244 published in NVD with CVSS 3.1 9.8 and Canon advisory CP2024-001
• 2024-07-01 ZDI updates advisory ZDI-24-095
• 2026-06-17 NVD record for CVE-2024-0244 last modified
• 2026-09-23 ZDI publishes Connor Ford's technical write-up of the root cause and Pwn2Own exploit chain using SOAP /wsd/print and BJNP

Sources cited

• ZDI-24-095: Canon imageCLASS MF753Cdw fax job heap-based buffer overflow RCE zerodayinitiative.com · Advisory · 2024-02-06
• NVD – CVE-2024-0244 NVD (NIST) · Advisory · 2024-02-06
• ZDI-24-562: Canon imageCLASS MF753Cdw setResource Buffer Overflow RCE (related CVE-2023-6234) zerodayinitiative.com · Advisory · 2024-05-31
• CVE-2024-0244 – A heap buffer overflow in the Canon MF753Cdw printer (Connor Ford, ZDI) thezdi.com · Research · 2026-09-23
• Canon PSIRT CP2024-001 psirt.canon · Vendor report · 2024-02-06
• Canon Japan – Vulnerability response (240205) canon.jp · Vendor report · 2024-02-05
• Canon USA – Service Notice: Buffer Overflow Vulnerability Measure for Laser Printers and Small Office MFPs usa.canon.com · Vendor report · 2024-02-06
• Canon Europe – Product security latest news canon-europe.com · Vendor report · 2024-02-06
• Pwn2Own 2021 Canon imageCLASS MF644Cdw writeup (UART shell reference) doar-e.github.io · Research · 2022-06-11

More in vulnerability

• Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation
• Windows SignDrop 0-Day: CLFS (clfs.sys) Local Privilege Escalation to SYSTEM with Public PoC (No CVE Assigned)
• Ivanti EPM SQLi RCE (CVE-2026-121653) and CSA Missing Authentication (CVE-2026-121683); Citrix XenServer and Ivanti Sentry/EPMM Patches
• Git Fixes 6 Vulnerabilities Enabling Code Execution via Cloned Repositories (CVE-2026-111760 et al.)
• Unpatched and end-of-support software on Windows endpoints exposes KEV-listed vulnerabilities (Acronis TRU telemetry; CVE-2023-38831, CVE-2026-59265)