The Canon ImageRunner remote UI web interface software will reveal username and password pairs contained in address book entries when the address book is exported. Tested and verified on Canon iR C3220, iR 5020, iR9070, iR C6800, iR C6870, and iR 8500.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/49767/canonDisclose.txt
Source: https://packetstormsecurity.com/files/49767/canonDisclose.txt.html