Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2006-4680: Canon imageRUNNER UI may leak passwords when exporting address book

CVE-2006-4680 · published 20 years ago

Summary

Several Canon imageRUNNER models (2620, 5020, 6870, 8500, 9070) include user names and passwords in the data exported from the Remote UI address book. This could let a nearby attacker capture login credentials for the device. Apply any available firmware updates and consider disabling address‑book export until the issue is fixed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
canon	imagerunner_2620	All versions `cpe:2.3:a:canon:imagerunner_2620::::::::`
canon	imagerunner_5020	All versions `cpe:2.3:a:canon:imagerunner_5020::::::::`
canon	imagerunner_6870	All versions `cpe:2.3:a:canon:imagerunner_6870::::::::`
canon	imagerunner_8500	All versions `cpe:2.3:a:canon:imagerunner_8500::::::::`
canon	imagerunner_9070	All versions `cpe:2.3:a:canon:imagerunner_9070::::::::`
canon	imagerunner_c3220	All versions `cpe:2.3:a:canon:imagerunner_c3220::::::::`
canon	imagerunner_c6800	All versions `cpe:2.3:a:canon:imagerunner_c6800::::::::`

Original advisory text

The Remote UI in Canon imageRUNNER includes usernames and passwords when exporting an address book, which allows context-dependent attackers to obtain sensitive information.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

4.0 Medium

Exploitation

1% chance of attack within 30 days

Timeline

Published11 Sep 2006

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2006-4680 · NVD

Track software like this

Free during beta