Cross-Site Request Forgeries (CSRF) Vulnerability

Vulnerability Reference: CVE-2023-27520

Description: A vulnerability has been identified in some Epson printers and network interface products in software (Web Config*) that can check the status of the product itself or change settings on a Web browser.

Impact: By accessing a specially crafted page, the settings of the product itself may be changed through the Web Config of the product.

Currently, there are no reports of attacks exploiting this vulnerability.

Target products and countermeasures

• Products other than the following are not affected because there are no vulnerabilities or measures have been taken at the time of shipment.

• For products that are currently on sale, we plan to release countermeasure firmware as follows. After the firmware is released, we strongly recommend that you download it from the Epson website and apply the update.

• For products that have not been supplied or are not scheduled to be supplied, we strongly recommend that you take measures by "Workaround method".

Workaround Method

In order for customers to use the product safely and securely, please install and configure it according to the security guidebook here.

• Installation according to the security guidebook
   
  1. Connecting to the internet
     
     The product should not be directly connected to the Internet and should be installed in a network protected by a firewall.
     
     In that case, please set a private IP address and operate.
      
  2. Administrator Password
     
     Set an administrator password for each product.
     
     The administrator password should be a complex string that is difficult for others to guess, such as mixing not only English characters but also symbols and numbers to make it 8 characters or more.
      
• Stronger workaround - Block HTTP (TCP/80 port) access to the product
  
  
  1. Blocked by product
     
     For the following products, you can block HTTP access (TCP/80 port) in Web Config*.
      
     • Commercial and Industrial Printers
       
       SureColor T5200 Series, SureColor T7200 Series, and SureColor T5200D Series
        
  2. Shut off network equipment in the installation environment
     
     After configuring the product, block HTTP access (TCP/80 port) to the product with a network device (router or switch).
     
     Open the port only when you need to update the application settings or firmware.

*Due to blockage, the functions in Web Config may not be available.

By downloading files from this page, you are agreeing to abide by the terms and conditions of Epson's Software License Agreement.