SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2023-23572

Cross-site scripting vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script. [Note] Web Config is the software that allows users to check…

MEDIUM 4.8EPSS 0.50%

Does this matter?

Lower severity and a low EPSS score (0.50%). Track it; it rarely justifies an emergency change on its own.

Description

Cross-site scripting vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script. [Note] Web Config is the software that allows users to check the status and change the settings of SEIKO EPSON printers/network interface via a web browser. According to SEIKO EPSON CORPORATION, it is also called as Remote Manager in some products. Web Config is pre-installed in some printers/network interface provided by SEIKO EPSON CORPORATION. For the details of the affected product names/model numbers, refer to the information provided by the vendor.

CVSS 3.1
4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
EPSS
0.50% probability · 41th percentile
CISA KEV
Not listed
Weakness
CWE-79
Affected
epson/lp-9200ps2 firmware · epson/lp-9200ps3 firmware · epson/lp-8200c firmware · epson/lp-9600 firmware · epson/lp-9600s firmware · epson/lp-9300 firmware · epson/lp-8500c firmware · epson/lp-8700ps3 firmware · epson/lp-9800c firmware · epson/lp-s5500 firmware · epson/lp-9200b firmware · epson/lp-9200c firmware · epson/lp-s4500 firmware · epson/lp-s6500 firmware · epson/lp-s7000 firmware · epson/lp-s5000 firmware · epson/lp-s4000 firmware · epson/lp-s6000 firmware · epson/lp-s5300 firmware · epson/lp-s5300r firmware · +30 more
Source
vultures@jpcert.or.jp

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.