Threat video1:00
CVE-2024-0244 Canon MF753Cdw Fax RCE: Detection & IOCs
Canon first disclosed CVE-2024-0244 in 2024 as an unauthenticated fax overflow. Its 9 detection rules, 8 IOCs and a free Splunk SPL rule are here.
Read the full threat intel for CVE-2024-0244 Canon MF753Cdw Fax RCE: Detection & IOCs →
Chapters
- 0:00The hookCanon printer flaw: 9.8.
- 0:04The storyFax jobs overflow.
- 0:10Attack pathA fax request triggers an overflow.
- 0:21AttributionNo threat actor is attributed.
- 0:26Indicators of compromise1 indicator to hunt: 1 path.
- 0:31MITRE ATT&CK techniques2 ATT&CK techniques, from initial access to command and control.
- 0:35Remediation2 steps now: Identify Canon MF750C-series / MF1333C / LBP1333C devices and confirm.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Canon printer flaw: 9.8.
0:05Fax jobs overflow.
0:06Canon issued a notice.
0:10A fax request triggers an overflow.
0:13Memory is then freed.
0:15On the same network, code execution is possible.
0:22No threat actor is attributed. Confidence: low.
0:261 indicator to hunt: 1 path.
0:312 ATT&CK techniques, from initial access to command and control.
0:362 steps now: Identify Canon MF750C-series / MF1333C / LBP1333C devices and confirm.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.