CVE-2021-20877

Name: CVE-2021-20877
Creator: NVD / NIST
Published: 2022-02-08T11:15:07.663+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 4.8/10EPSS 0.83%

Last modified Jun 17, 2026

CVE-2021-20877 is a medium-severity vulnerability rated 4.8/10 on the CVSS scale. Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, MF4890dw, MF269dw/MF265dw/MF264dw/MF262dw, MF249dw/MF245dw/MF244dw/MF242dw/MF232w, and MF229dw/MF224dw/MF222dw sold in Japan, imageCLASS MF Series (MF113W/MF212W/MF217W/MF227DW/MF229DW, MF232W/MF244DW/MF247DW/MF249DW, MF264DW/MF267DW/MF269DW/MF269DW VP, and MF4570DN/MF4570DW/MF4770N/MF4880DW/MF4890DW) and imageCLASS LBP Series (LBP113W/LBP151DW/LBP162DW ) sold in the US, and iSENSYS (LBP162DW, LBP113W, LBP151DW, MF269dw, MF267dw, MF264dw, MF113w, MF249dw, MF247dw, MF244dw, MF237w, MF232w, MF229dw, MF217w, MF212w, MF4780w, and MF4890dw) and imageRUNNER (2206IF, 2204N, and 2204F) sold in Europe) allows remote attackers to inject an arbitrary script via unspecified vectors.. EPSS estimates a 0.83% chance of exploitation in the next 30 days.

Description

Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, MF4890dw, MF269dw/MF265dw/MF264dw/MF262dw, MF249dw/MF245dw/MF244dw/MF242dw/MF232w, and MF229dw/MF224dw/MF222dw sold in Japan, imageCLASS MF Series (MF113W/MF212W/MF217W/MF227DW/MF229DW, MF232W/MF244DW/MF247DW/MF249DW, MF264DW/MF267DW/MF269DW/MF269DW VP, and MF4570DN/MF4570DW/MF4770N/MF4880DW/MF4890DW) and imageCLASS LBP Series (LBP113W/LBP151DW/LBP162DW ) sold in the US, and iSENSYS (LBP162DW, LBP113W, LBP151DW, MF269dw, MF267dw, MF264dw, MF113w, MF249dw, MF247dw, MF244dw, MF237w, MF232w, MF229dw, MF217w, MF212w, MF4780w, and MF4890dw) and imageRUNNER (2206IF, 2204N, and 2204F) sold in Europe) allows remote attackers to inject an arbitrary script via unspecified vectors.

Metrics

CVSS 3.1

4.8/10

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS Probability

0.83%

52.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-79

Affected Software

Vendor	Product	Versions
Canon	2204f	All versions
Canon	2204n	All versions
Canon	2206if	All versions
Canon	Lbp113w	All versions
Canon	Lbp151dw	All versions
Canon	Lbp162	All versions
Canon	Lbp162dw	All versions
Canon	Lbp162l	All versions
Canon	Mf113w	All versions
Canon	Mf212w	All versions
Canon	Mf217w	All versions
Canon	Mf222dw	All versions
Canon	Mf224dw	All versions
Canon	Mf227dw	All versions
Canon	Mf229dw	All versions
Canon	Mf232w	All versions
Canon	Mf237w	All versions
Canon	Mf242dw	All versions
Canon	Mf244dw	All versions
Canon	Mf245dw	All versions
Canon	Mf247dw	All versions
Canon	Mf249dw	All versions
Canon	Mf262dw	All versions
Canon	Mf264dw	All versions
Canon	Mf265dw	All versions
Canon	Mf267dw	All versions
Canon	Mf269dw	All versions
Canon	Mf269dw Vp	All versions
Canon	Mf4570dn	All versions
Canon	Mf4570dw	All versions
Canon	Mf4770n	All versions
Canon	Mf4780w	All versions
Canon	Mf4880dw	All versions
Canon	Mf4890dw	All versions

References

https://cweb.canon.jp/e-support/info/211221xss.htmlVendor Advisory
https://jvn.jp/en/jp/JVN64806328/index.htmlThird Party Advisory
https://jvn.jp/jp/JVN64806328/index.htmlThird Party Advisory
https://www.canon-europe.com/support/product-security-latest-news/Vendor Advisory
https://www.usa.canon.com/internet/portal/us/home/support/product-advisories/detail/Service-Notice-Canon-Laser-Printer-and-Small-Office-Multifunctional-Printer-related-to-cross-site-scriptingVendor Advisory
https://cweb.canon.jp/e-support/info/211221xss.htmlVendor Advisory
https://jvn.jp/en/jp/JVN64806328/index.htmlThird Party Advisory
https://jvn.jp/jp/JVN64806328/index.htmlThird Party Advisory
https://www.canon-europe.com/support/product-security-latest-news/Vendor Advisory
https://www.usa.canon.com/internet/portal/us/home/support/product-advisories/detail/Service-Notice-Canon-Laser-Printer-and-Small-Office-Multifunctional-Printer-related-to-cross-site-scriptingVendor Advisory

Timeline

Published: Feb 8, 2022
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2021-20877?

How severe is CVE-2021-20877?

CVE-2021-20877 has a CVSS score of 4.8/10 (MEDIUM severity). The EPSS model estimates a 0.83% probability of exploitation in the next 30 days.

How do I fix CVE-2021-20877?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-20877?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST