Vulnerability in Web Config in Printers and Network Interface Products

Thank you for using Epson products.

A vulnerability has been identified in some Epson printers and network interface products in software (Web Config*) that can check the status of the product itself or change settings on a Web browser.

* Web Config allows you to check the status of the product or change the settings by entering the IP address of the product in the URL field on a web browser such as Edge or Safari. Web Config may be referred to as Remote Manager in some products.

• Confirmed vulnerabilities

The following two vulnerabilities have been identified.

1. Cross-Site Scripting (XSS) Vulnerability
   By accessing a specially crafted page, a script may be embedded in the settings of the product itself through the Web Config of the product in question.


2. Cross-Site Request Forgeries (CSRF) vulnerability
   By accessing a specially crafted page, the settings of the product itself may be changed through the Web Config of the product.
• Impact of vulnerability

Currently, there are no reports of attacks exploiting this vulnerability.

• Target products and countermeasures
  
  
  • Products other than the following are not affected because there are no vulnerabilities or measures have been taken at the time of shipment.
  
  
  • For products that are currently on sale, we plan to release countermeasure firmware as follows. After the firmware is released, we strongly recommend that you download it from the Epson website and apply the update.
  
  
  • For products that have not been supplied or are not scheduled to be supplied, we strongly recommend that you take measures by "Workaround method".

• Workaround method

In order for customers to use the product safely and securely, please install and configure it according to the security guidebook.

• Installation and configuration according to the security guidebook
  1. Connecting to the Internet

  The product should not be directly connected to the Internet and should be installed in a network protected by a firewall. In that case, please set a private IP address and operate.

  2. Administrator password

  Set an administrator password for each product.
  The administrator password should be a complex string that is difficult for others to guess, such as mixing not only English characters but also symbols and numbers to make it 8 characters or more.

  Please check the Security Guidebook here.

• Stronger workaround – Block HTTP (TCP/80 port) access to the product


1. Blocked by product

For the following products, you can block HTTP access (TCP/80 port) in Web Config.

• Business Printer: AcuLaser C9300N/ AcuLaser M7000N
• Commercial & Industrial Printers: SC-T3200 Series/SC-T5200 Series/SC-T7200 Series/SC-T5200D Series/SC-T7200D Series


2. Shut off by network equipment in the installation environment

After configuring the product, block HTTP access (TCP/80 port) to the product with a network device (router or switch). Open the port only when you need to update the application settings or firmware.
* Due to blockage, the functions in Web Config may not be available.