DCSG1 - Pwn2Own Level Break of a Printer - SungJun Park, WonBeen Im
Source: YouTube · DEFCONConference · published Sep 30, 2026 · 41:09
At Pwn2Own Ireland 2025, South Korea's Petworks hacked a Canon imageCLASS MF654CDW printer via an invalid free bug in Canon's proprietary CPCA protocol, earning $10,000 and two Master of Pwn points 0:14.
Key Takeaways:
- Weak mitigations: Canon printers run DryOS, a camera-derived RTOS with no ASLR or sandboxing—"early 2000s exploitation" 3:38
- Recon: A UART interface gave shell access; "removed" debug commands (memory dump/modify) remained hidden in firmware 7:02
- Firmware via eBay: Canon's download requires a matching serial number; the team found one in a high-resolution eBay listing photo 9:59
- The bug: CPCA's delete-file handler allocates one contiguous buffer, but the free path calls free() on each element as if it were a pointer array—invalid frees missed by compilers and static analyzers: "a bug of understanding, not bug of writing" 18:29
Using CPCA's CADM echo function for heap grooming, they achieved arbitrary heap free, replaced the PJCC handler table for PC control, and bypassed NX via the ARM domain access control register—defacing the display with ~90% reliability 27:04.
CVE-2025-14233 was rated critical (CVSS 9.3), affecting many Canon models. Printers sit on internal networks but are poorly monitored—treat them as critical security boundaries 40:21.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Let's start the real deal. We're going to welcome our speakers. They are going to be talking about exploiting the unexpected when it comes to printers. >> Ready? >> Yeah. >> All right. Let's give another round of applause. >> Yeah. Hi everyone. Thanks for coming. And our talk today is uh the title is exploring the unexpected a pontoon level breaker printer. Yeah. Over the next 40 minutes, we are going to talk you through how we broke a printer and at Pon Island 2025 and more importantly all the pain we went through to get there. Yeah. Yeah. Let's introduce ourself. Yeah. I'm Sunjun and this is my colleague Win. We are from South Korea uh uh startup company Petworks and mostly we conduct offensive security research such as like Gerro day and exploit and some like embedded security stuff. Ye…