Service Notice: Canon imageFORMULA Scanners Vulnerabilities Found in the Firmware

Canon U.S.A., Inc. has recently become aware, under limited conditions, such as an open network configuration, that there may be a chance that a malicious third party could exploit this vulnerability to gain unauthorized access to the device. Canon’s imageFORMULA products are designed for use in corporate LAN environments protected by a corporate firewall and network security products. It would require a serious security breach, such as intrusion inside the corporate LAN, for a malicious third-party to exploit this vulnerability. For this reason, the risk of potential impact from this vulnerability should be limited if the product is used in a typical corporate environment.

As of the date of this Service Notice, there have been no reports of damage or unauthorized use resulting from this vulnerability.

This vulnerability relates to the following publicly available information:

  • Potential XSS vulnerability in jQuery:CVE-2020-11022、CVE-2020-11023
  • Lighttpd NULL pointer dereference:CVE-2022-37797
  • Lighttpd MadeYouReset DoS issue:CVE-2025-8671
  • Lighttpd Resource leak DoS issue:CVE-2022-41556
  • D(HE)at Attack DoS issue:CVE-2002-20001
  • Diffie-Hellman long exponent DoS issue:CVE-2022-40735
  • Diffie-Hellman public key order validation DoS issue:CVE-2024-41996
  • Lighttpd Path traversal:CVE-2018-19052

Affected models and firmware version:

imageFORMULA Scanners

Model Firmware
CR-120N 2.03.20201224
DR-S150 2.49.2022.1107
NA10 1.56.2023.0124
R50 2.52.2024.0927
WA10 1.56.2023.0124


Note: If we determine that additional models could potentially be impacted by this vulnerability, we will issue an updated Service Notice.

Please periodically check the support website of Canon U.S.A., Inc. for firmware updates.

GET SUPPORT
Need help with your product? Let us help you find what you need.
Product Support
NEED IT FIRST
Sign up for up-to-the-minute Canon News, Sales and Deals.
LEARN WITH CANON
Discover great new ways to enjoy your products with exclusive articles, training and events.
Learn more