Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-12048: Canon LBP7110Cw web interface allows full access without PIN

CVE-2018-12048 · published 8 years ago

Summary

The web administration page of the Canon LBP7110Cw printer can be accessed remotely without entering the required PIN, giving an attacker complete control of the device. This occurs when the printer is left with its default settings and the recommended security steps are not applied. Change the default configuration and follow Canon’s security guidelines to protect the printer.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
canon	lbp7110cw_firmware	All versions `cpe:2.3:o:canon:lbp7110cw_firmware:-:::::::*`

Original advisory text

A remote attacker can bypass the Management Mode on the Canon LBP7110Cw web interface without a PIN for /checkLogin.cgi via vectors involving /portal_top.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the default settings without using the countermeasures and best practices shown in the documentation

References

https://gist.github.com/huykha/455e7d3b86eb6629066d921f46bfcee3 Broken Link Third Party Advisory
https://www.exploit-db.com/exploits/44885/ Broken Link Third Party Advisory VDB Entry

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

5% chance of attack within 30 days

Type

CWE-287Improper Authentication

Timeline

Published8 Jun 2018

Updated25 Oct 2026

First seen29 Sep 2026

Sources

CVE-2018-12048 · NVD

Track software like this

Free during beta