Cross-Site Scripting (XSS) Vulnerability

Vulnerability Reference: CVE-2023-23572

Description: A vulnerability has been identified in some Epson printers and network interface products in software (Web Config*) that can check the status of the product itself or change settings on a Web browser.

Impact: By accessing a specially crafted page, a script may be embedded in the settings of the product itself through the Web Config of the product in question. Currently, there are no reports of attacks exploiting this vulnerability.

Solution: To ensure the security of your Epson product, please download and install the latest EPSON Firmware Update for your product by navigating to your product's support page. It is recommeneded to follow one or both of the following procedures to secure your Epson product.

Workaround Procedure 1:

1. The product should not be directly connected to the Internet and should be installed in a network protected by a firewall.

In that case, please set a private IP address and operate.

2. Set an administrator password for each product.

The administrator password should be a complex string that is difficult for others to guess, such as mixing not only English characters but also symbols and numbers to make it 8 characters or more.

Please check the Security Guidebook here.

Workaround Procedure 2:

For the affected products, you can block HTTP access (TCP/80 port) in Web Config. 

After configuring the product, block HTTP access (TCP/80 port) to the product with a network device (router or switch). 

Open the port only when you need to update the application settings or firmware.

By downloading files from this page, you are agreeing to abide by the terms and conditions of Epson's Software License Agreement.