SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2023-27520

Cross-site request forgery (CSRF) vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote unauthenticated attacker to hijack the authentication and perform unintended operations by having a logged-in user view a malicious…

MEDIUM 6.5EPSS 0.31%

Does this matter?

Lower severity and a low EPSS score (0.31%). Track it; it rarely justifies an emergency change on its own.

Description

Cross-site request forgery (CSRF) vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote unauthenticated attacker to hijack the authentication and perform unintended operations by having a logged-in user view a malicious page. [Note] Web Config is the software that allows users to check the status and change the settings of SEIKO EPSON printers/network interface via a web browser. According to SEIKO EPSON CORPORATION, it is also called as Remote Manager in some products. Web Config is pre-installed in some printers/network interface provided by SEIKO EPSON CORPORATION. For the details of the affected product names/model numbers, refer to the information provided by the vendor.

CVSS 3.1
6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS
0.31% probability · 24th percentile
CISA KEV
Not listed
Weakness
CWE-352
Affected
epson/lp-9200ps2 firmware · epson/lp-9200ps3 firmware · epson/lp-8200c firmware · epson/lp-9600 firmware · epson/lp-9600s firmware · epson/lp-9300 firmware · epson/lp-8500c firmware · epson/lp-8700ps3 firmware · epson/lp-9800c firmware · epson/lp-s5500 firmware · epson/lp-9200b firmware · epson/lp-9200c firmware · epson/lp-s4500 firmware · epson/lp-s6500 firmware · epson/lp-s7000 firmware · epson/lp-s5000 firmware · epson/lp-s4000 firmware · epson/lp-s6000 firmware · epson/lp-s5300 firmware · epson/lp-s5300r firmware · +40 more
Source
vultures@jpcert.or.jp

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.