-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID:               SYSS-2023-011
Product:                   PIXMA TR4550
Manufacturer:              Canon
Affected Version(s):       1.020 / 1.080
                           also affects many other Canon inkjet printer models[4]
Tested Version(s):         1.020 / 1.080
Vulnerability Type:        Insufficient or Incomplete Data Removal within
                           Hardware Component (CWE-1301)
                           Insufficiently Protected Credentials (CWE-522)
Risk Level:                Low
Solution Status:           Fixed
Manufacturer Notification: 2023-04-06
Solution Date:             2023-07-31
Public Disclosure:         2023-08-03
CVE Reference:             No CVE ID from Canon PSIRT
Author of Advisory:        Manuel Stotz, SySS GmbH

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

The Canon PIXMA TR4550 is an entry-level 4-in-1 printer equipped with
Wi-Fi connectivity.

The manufacturer describes the product as follows (see [1]):

"Ready to adapt to your smart home office environment, this efficient
4-In-One printer requires minimal space but gives maximum support to
your projects. Whether scanning a document, copying an ID, faxing an
invoice or printing posters, PIXMA TR4550 has the functionality to keep
up with your business needs. Equipped with smart Wi-Fi connectivity to
optimise management of functions and features, this front-loading
4-In-One printer is the compact solution that saves space, streamlines
ink usage and brings productivity to the forefront."

The unprotected storage of credentials and insufficient data removal
during a factory reset allows sensitive data to be read out afterward.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

The Canon PIXMA TR4550 stores sensitive data, such as the SSID and the
Wi-Fi pre-shared key (PSK), unencrypted in its persistent storage
(EEPROM).

Resetting the product to factory settings (via 'Setup', 'Device
settings', 'Reset setting' and 'All data') does not securely delete this
sensitive information.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

SySS could successfully perform a proof-of-concept attack via the
following steps:

* Configure and establish a Wi-Fi connection.
* Reset all data (Setup, Device settings, Reset setting, All data).
* Disassemble the printer and locate the EEPROM on the PCB.
* Create an EEPROM memory dump.
* Search and locate the configured SSID and PSK in the memory dump.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

Canon PSIRT published its security advisory "Vulnerability 
Mitigation/Remediation for Inkjet Printers (Home and Office/Large 
Format)" (CP2023-003)[3] describing how sensitive information should be
deleted concerning the affected printers[5].

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2023-04-06: Vulnerability reported to manufacturer
2023-04-12: Canon PSIRT creates ticket
2023-04-27: Update from Canon concerning ongoing analysis
2023-05-15: Canon confirms security issue
2023-05-23: Agreement on public disclosure date
2023-07-17: Canon PSIRT informs about scheduled publication of their 
            security advisory
2023-07-31: Canon PSIRT publishes their security advisory "Vulnerability 
            Mitigation/Remediation Format Inkjet Printers (Home and 
            Office/Large Format)" (CP2023-003)[3]
2023-08-03: Public release of SySS security advisory

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product website for Canon PIXMA TR4550
    https://www.canon-europe.com/support/consumer/products/printers/pixma/tr-series/pixma-tr4550.html
[2] SySS Security Advisory SYSS-2023-011
    https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-011.txt
[3] CP2023-003 Vulnerability Mitigation/Remediation for Inkjet Printers (Home and Office/Large Format)
    https://psirt.canon/advisory-information/cp2023-003/
[4] List of affected printers
    https://canon.a.bigcontent.io/v1/static/affected-models_20230731_d04c0d9895124b65acd21ca68357dcdc
[5] SySS Responsible Disclosure Policy
    https://www.syss.de/en/responsible-disclosure-policy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Manuel Stotz of SySS GmbH.

E-Mail: manuel.stotz (at) syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Manuel_Stotz.asc
Key Fingerprint: F051 5B74 7E70 193E 7F66 0133 E790 F68A BCE6 8C6D

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS website.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE0fCgNfBs5nXNuQUU2aS/ajStTasFAmTLR2gACgkQ2aS/ajSt
Tasb3Q/9HG507aU7Mtj+g9cygmd2/AIqAgX9614Xzrh4KAU9S4oVghir6lj2OtkU
NBYbV6yj7MJgb4IOL5GnaUwFxd7kIx9MM5YJwi1LBxq4IhT7wExaZJcbsomAqhbG
3/dkFA/hA9ElsujKRQQ9ADMmdvNhUK6nlDvf0IEIGlfumufDg+2OaRGJ7pg2Uvau
6sf51V8IZnhTcVwdtO+nICjmSBGVgW4C7xhRlNNnnVX1uk2zGr2oZ8L/aqT6uL3g
+CINujQJP9uqTWYqnh8Qy7EPVGfAKsZICjSm0OlJJ/DKjUG1lkjMhz4Go2eGcRNp
yRYzFKPcJBo6jwAxFWAKCWfnRqk0WGNG4miwYsPIy/UZgd2G74oB+U0VxS22B1lw
wmc/pRfnfMfELNWYz7J4UXNqri2yYFlKFbmv1b2Xb5U0mw7zE+UkK6pDzZWFCCzC
dPs6UZ7VU9l9KgCASgZbtFhf04xnCwFkXeq17/BFrbqOY2IjCWgJtval2fgXPAhr
JV6xy8eXQ2SFOW/x613P5j+RQOdCglkWis8t1cD4IASp1ciVHvZKJsvFG/hMVFp+
Xonhbz7BWtWukV5+TTUyhW67us+clvfxEFEiA0wlR0uylrXhQ8cX6o5ZvaPDcQ4x
RU/NY5jDZblHTBHmKVYuOd9PyVHgtQS8WLAHO8CBGya+ZCW3rvE=
=MfFk
-----END PGP SIGNATURE-----