topic Re: Web Server Uses Plain-Text Form Based Authentication in Production Printing

imageRUNNER ADVANCE DX C3725 Web Server Uses Plain-Text Form Based Authentication

Wozy24 — Thu, 15 Feb 2024 14:03:40 GMT

Dear Support,

In our company we are using a Canon ImageRunner Advance DX C3725 printer and we have an issue that it is considered to be a vulnerability and the recommendation given to troubleshoot this issue is to contact the vendor.

Please find below the description of the vulnerability:

"The Web Server uses plain-text form based authentication. A web page exists on the target host which uses an HTML login form. This data is sent from the client to the server in plain-text. An attacker with access to the network traffic to and from the target host may be able to obtain login credential for other users by sniffing the network"

How can we solve this issue that it's considered to be a vulnerability?

Re: Web Server Uses Plain-Text Form Based Authentication

Stephen — Thu, 15 Feb 2024 13:51:19 GMT

Thanks for posting!

While our Forum Community members are welcome to chime in, Canon does not provide direct support for imageRUNNER series products, but your dealer will be able to help you! You should be able to find a decal on the front or side of your unit with your dealer's contact information.

If you don't have a dealer, please call us at 1-800-OK-CANON (1-800-652-2666), and we will be happy to provide you with the names of dealers in your area!

Re: imageRUNNER ADVANCE DX C3725 Web Server Uses Plain-Text Form Based Authentication

shadowsports — Thu, 15 Feb 2024 14:58:26 GMT

Greetings,

I suspect your Image Runner is behind a firewall. This means that someone would have to be on your internal network to access or intercept plain text being sent to / from its webserver. If you enable https, the traffic and connection would be encrypted. You can review recommendations for hardening security here:

downloadasset (canon.com)