Advisory ID:               SYSS-2023-011
Product:                   PIXMA TR4550
Manufacturer:              Canon
Affected Version(s):       1.020 / 1.080
                            also affects many other Canon inkjet printer
                            models[4]
Tested Version(s):         1.020 / 1.080
Vulnerability Type:        Insufficient or Incomplete Data Removal
                            within Hardware Component (CWE-1301)
                            Insufficiently Protected Credentials
                            (CWE-522)
Risk Level:                Low
Solution Status:           Fixed
Manufacturer Notification: 2023-04-06
Solution Date:             2023-07-31
Public Disclosure:         2023-08-03
CVE Reference:             No CVE ID from Canon PSIRT
Author of Advisory:        Manuel Stotz, SySS GmbH

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

The Canon PIXMA TR4550 is an entry-level 4-in-1 printer equipped with
Wi-Fi connectivity.

The manufacturer describes the product as follows (see [1]):

"Ready to adapt to your smart home office environment, this efficient
4-In-One printer requires minimal space but gives maximum support to
your projects. Whether scanning a document, copying an ID, faxing an
invoice or printing posters, PIXMA TR4550 has the functionality to keep
up with your business needs. Equipped with smart Wi-Fi connectivity to
optimise management of functions and features, this front-loading
4-In-One printer is the compact solution that saves space, streamlines
ink usage and brings productivity to the forefront."

The unprotected storage of credentials and insufficient data removal
during a factory reset allows sensitive data to be read out afterward.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

The Canon PIXMA TR4550 stores sensitive data, such as the SSID and the
Wi-Fi pre-shared key (PSK), unencrypted in its persistent storage
(EEPROM).

Resetting the product to factory settings (via 'Setup', 'Device
settings', 'Reset setting' and 'All data') does not securely delete this
sensitive information.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

SySS could successfully perform a proof-of-concept attack via the
following steps:

* Configure and establish a Wi-Fi connection.
* Reset all data (Setup, Device settings, Reset setting, All data).
* Disassemble the printer and locate the EEPROM on the PCB.
* Create an EEPROM memory dump.
* Search and locate the configured SSID and PSK in the memory dump.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

Canon PSIRT published its security advisory "Vulnerability
Mitigation/Remediation for Inkjet Printers (Home and Office/Large
Format)" (CP2023-003)[3] describing how sensitive information should be
deleted concerning the affected printers[5].

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2023-04-06: Vulnerability reported to manufacturer
2023-04-12: Canon PSIRT creates ticket
2023-04-27: Update from Canon concerning ongoing analysis
2023-05-15: Canon confirms security issue
2023-05-23: Agreement on public disclosure date
2023-07-17: Canon PSIRT informs about scheduled publication of their
             security advisory
2023-07-31: Canon PSIRT publishes their security advisory "Vulnerability
             Mitigation/Remediation Format Inkjet Printers (Home and
             Office/Large Format)" (CP2023-003)[3]
2023-08-03: Public release of SySS security advisory

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product website for Canon PIXMA TR4550
 
https://www.canon-europe.com/support/consumer/products/printers/pixma/tr-series/pixma-tr4550.html
[2] SySS Security Advisory SYSS-2023-011
 
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-011.txt
[3] CP2023-003 Vulnerability Mitigation/Remediation for Inkjet Printers 
(Home and Office/Large Format)
     https://psirt.canon/advisory-information/cp2023-003/
[4] List of affected printers
 
https://canon.a.bigcontent.io/v1/static/affected-models_20230731_d04c0d9895124b65acd21ca68357dcdc
[5] SySS Responsible Disclosure Policy
     https://www.syss.de/en/responsible-disclosure-policy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Manuel Stotz of SySS GmbH.

E-Mail: manuel.stotz (at) syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Manuel_Stotz.asc
Key Fingerprint: F051 5B74 7E70 193E 7F66 0133 E790 F68A BCE6 8C6D

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS website.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en