Canon Oce Colorwave 500 Firmware vulnerabilities

5 CVEs affecting Canon Oce Colorwave 500 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-10669, published 2020-03-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-10669, published 2020-03-19. High severity, CVSS 7.5. EPSS: 3.5% chance of exploitation in the next 30 days. The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to authentication bypass on the page /home.jsp. An unauthenticated attacker able to connect to the device's…
CVE-2020-10667, published 2020-03-19. Medium severity, CVSS 6.1. EPSS: 1.8% chance of exploitation in the next 30 days. The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Stored XSS in /TemplateManager/indexExternalLocation.jsp. The vulnerable parameter is map(template_name).…
CVE-2020-10668, published 2020-03-19. Medium severity, CVSS 6.1. EPSS: 1.4% chance of exploitation in the next 30 days. The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in /home.jsp. The vulnerable parameter is openSI. NOTE: this is fixed in the latest version.
CVE-2020-10670, published 2020-03-19. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in the parameter settingId of the settingDialogContent.jsp page. NOTE: this is fixed in the…
CVE-2020-10671, published 2020-03-19. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. The Canon Oce Colorwave 500 4.0.0.0 printer's web application is missing any form of CSRF protections. This is a system-wide issue. An attacker could perform administrative actions by targeting a…