What is the CVSS score of CVE-2020-16849?

CVE-2020-16849 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 1.1%.

Mf237W Firmware CVE-2020-16849

HIGH

2020-11-30 cve@mitre.org

Information Disclosure Mf237W Firmware Mf113W Firmware Mf212W Firmware Mf216N Firmware Mf217W Firmware Mf226Dn Firmware Mf229Dw Firmware Mf231 Firmware Mf232W Firmware Mf244Dw Firmware Mf247Dw Firmware Mf249Dw Firmware Mf264Dw Firmware Mf267Dw Firmware Mf269Dw Firmware Mf4570Dn Firmware Mf4580Dn Firmware Mf4780W Firmware Mf4870Dn Firmware Mf4890Dw Firmware Lbp113W Firmware Lbp151Dw Firmware Lbp162Dw Firmware Ir2202N Firmware Ir2204N Firmware Ir2204F Firmware Ir2206N Firmware Ir2206If Firmware

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Nov 30, 2020 - 22:15 nvd

HIGH 7.5

DescriptionNVD

AnalysisAI

An issue was discovered on Canon MF237w 06.07 devices. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

An issue was discovered on Canon MF237w 06.07 devices. An "Improper Handling of Length Parameter Inconsistency" issue in the IPv4/ICMPv4 component, when handling a packet sent by an unauthenticated network attacker, may expose Sensitive Information. Affected products include: Canon Mf237W Firmware, Canon Mf113W Firmware, Canon Mf212W Firmware, Canon Mf216N Firmware, Canon Mf217W Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.