What’s Vulnerable › Vulnerabilities

CVE-2021-20877

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-02-08 · updated 2026-06-17
• Weakness: CWE-79

Description

Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, MF4890dw, MF269dw/MF265dw/MF264dw/MF262dw, MF249dw/MF245dw/MF244dw/MF242dw/MF232w, and MF229dw/MF224dw/MF222dw sold in Japan, imageCLASS MF Series (MF113W/MF212W/MF217W/MF227DW/MF229DW, MF232W/MF244DW/MF247DW/MF249DW, MF264DW/MF267DW/MF269DW/MF269DW VP, and MF4570DN/MF4570DW/MF4770N/MF4880DW/MF4890DW) and imageCLASS LBP Series (LBP113W/LBP151DW/LBP162DW ) sold in the US, and iSENSYS (LBP162DW, LBP113W, LBP151DW, MF269dw, MF267dw, MF264dw, MF113w, MF249dw, MF247dw, MF244dw, MF237w, MF232w, MF229dw, MF217w, MF212w, MF4780w, and MF4890dw) and imageRUNNER (2206IF, 2204N, and 2204F) sold in Europe) allows remote attackers to inject an arbitrary script via unspecified vectors.

Affected products

• Canon 2204F: all versions
• Canon 2204N: all versions
• Canon 2206If: all versions
• Canon Lbp113W: all versions
• Canon Lbp151Dw: all versions
• Canon Lbp162: all versions
• Canon Lbp162Dw: all versions
• Canon Lbp162L: all versions
• Canon Mf113W: all versions
• Canon Mf212W: all versions
• Canon Mf217W: all versions
• Canon Mf222Dw: all versions
• Canon Mf224Dw: all versions
• Canon Mf227Dw: all versions
• Canon Mf229Dw: all versions
• Canon Mf232W: all versions
• Canon Mf237W: all versions
• Canon Mf242Dw: all versions
• Canon Mf244Dw: all versions
• Canon Mf245Dw: all versions
• Canon Mf247Dw: all versions
• Canon Mf249Dw: all versions
• Canon Mf262Dw: all versions
• Canon Mf264Dw: all versions
• Canon Mf265Dw: all versions
• Canon Mf267Dw: all versions
• Canon Mf269Dw: all versions
• Canon Mf269Dw Vp: all versions
• Canon Mf4570Dn: all versions
• Canon Mf4570Dw: all versions

References

• https://cweb.canon.jp/e-support/info/211221xss.html
• https://jvn.jp/en/jp/JVN64806328/index.html
• https://jvn.jp/jp/JVN64806328/index.html
• https://www.canon-europe.com/support/product-security-latest-news/
• https://www.usa.canon.com/internet/portal/us/home/support/product-advisories/detail/Service-Notice-Canon-Laser-Printer-and-Small-Office-Multifunctional-Printer-related-to-cross-site-scripting
• https://cweb.canon.jp/e-support/info/211221xss.html
• https://jvn.jp/en/jp/JVN64806328/index.html
• https://jvn.jp/jp/JVN64806328/index.html
• https://www.canon-europe.com/support/product-security-latest-news/
• https://www.usa.canon.com/internet/portal/us/home/support/product-advisories/detail/Service-Notice-Canon-Laser-Printer-and-Small-Office-Multifunctional-Printer-related-to-cross-site-scripting

Get alerted when CVE-2021-20877 or the next vulnerability affects your stack