CVE-2020-26508

CRITICAL

Canon Oce ColorWave 3500 <5.1.1.0 - Info Disclosure

Title source: llm
STIX 2.1

Description

The WebTools component on Canon Oce ColorWave 3500 5.1.1.0 devices allows attackers to retrieve stored SMB credentials via the export feature, even though these are intentionally inaccessible in the UI.

References (1)

Core 1
Core References
Third Party Advisory x_refsource_misc
https://www.syss.de/pentest-blog/

Scores

CVSS v3 9.8
EPSS 0.0112
EPSS Percentile 61.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-522
Status published
Products (1)
canon/oce_colorwave_3500_firmware 5.1.1.0
Published Nov 16, 2020
Tracked Since Feb 18, 2026