Canon IJ Scan Utility Unquoted Service Path Vulnerability Allowing Arbitrary File Execution

A vulnerability exists in Canon IJ Scan Utility for Windows, versions 1.1.2 through 1.5.0, due to an unquoted executable path in a Windows service. This flaw may enable a local attacker to execute a malicious file with the service's privileges, particularly if the file path includes spaces.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of files with elevated privileges, potentially allowing for malicious actions to be performed under the guise of the affected service.

Remediation

Users are advised to install the latest MP Driver, which includes a patched version of IJ Scan Utility for Windows. The updated software can be downloaded from the Canon Software Download page. After installation, verify that IJ Scan Utility for Windows version 1.6.0 or higher is installed.