Vulnerability in Web Config in Printers and Network Interface Products

Thank you for using Epson products.

Vulnerability Reference: CVE-2023-27520

A vulnerability has been identified in some Epson printers and network interface products in software (Web Config*) that can check the status of the product itself or change settings on a Web browser.

* Web Config allows you to check the status of the product or change the settings by entering the IP address of the product in the URL field on a web browser such as Edge or Safari. Web Config may be referred to as Remote Manager in some products.

The following two vulnerabilities have been identified.

Currently, there are no reports of attacks exploiting this vulnerability.

• Confirmed vulnerabilities
  1. Cross-Site Scripting (XSS) Vulnerability
     By accessing a specially crafted page, a script may be embedded in the settings of the product itself through the Web Config of the product in question.
  
  
  2. Cross-Site Request Forgeries (CSRF) vulnerability
     By accessing a specially crafted page, the settings of the product itself may be changed through the Web Config of the product.
• Impact of vulnerability
  • Currently, there are no reports of attacks exploiting this vulnerability.
• Target products and countermeasures
  
  
  • Products other than the following are not affected because there are no vulnerabilities or measures have been taken at the time of shipment.
  
  
  • For products that are currently on sale, we plan to release countermeasure firmware as follows. After the firmware is released, we strongly recommend that you download it from the Epson website and apply the update.
  
  
  • For products that have not been supplied or are not scheduled to be supplied, we strongly recommend that you take measures by "Workaround method".

In order for customers to use the product safely and securely, please install and configure it according to the security guidebook.

• Workaround method
  • Installation and configuration according to the security guidebook

    The product should not be directly connected to the Internet and should be installed in a network protected by a firewall. In that case, please set a private IP address and operate.

    Set an administrator password for each product.
    The administrator password should be a complex string that is difficult for others to guess, such as mixing not only English characters but also symbols and numbers to make it 8 characters or more.

    Please check the Security Guidebook here.

    1. Connecting to the Internet
    2. Administrator password
  • Stronger workaround – Block HTTP (TCP/80 port) access to the product

    For the following products, you can block HTTP access (TCP/80 port) in Web Config.

    After configuring the product, block HTTP access (TCP/80 port) to the product with a network device (router or switch). Open the port only when you need to update the application settings or firmware.
    * Due to blockage, the functions in Web Config may not be available.

    1. Blocked by product
       • Business Printer: AcuLaser C9300N/ AcuLaser M7000N
       • Commercial & Industrial Printers: SC-T3200 Series/SC-T5200 Series/SC-T7200 Series/SC-T5200D Series/SC-T7200D Series
    
    
    2. Shut off by network equipment in the installation environment