Vulnerability · Published Nov 24, 2020 · Assigned by jpcert
CVE-2020-5674
High 7.8
In plain English
A high-severity security flaw in the installers of multiple SEIKO EPSON products from SEIKO EPSON CORPORATION. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.3%top 71.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Untrusted search path vulnerability in the installers of multiple SEIKO EPSON products allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SEIKO EPSON CORPORATION | the installers of multiple SEIKO EPSON products | A wide range of versions for the following products are affected -- Epson Web Installer, EPSON printer drivers, EPSON scanner drivers, EPSON Scan ICM Updaters, EPSON Printer Window!3, EPSON Printer Window!2 Firmware update programs, Network configuration utilities, Network print port monitors, Printer monitor SDK, Colorio series, Large-size printer related software, Laser printers, Copy station related software, Dot impact printer related software, Disk duplicator related software, CRYSTARIO related software, SureLab related software, Offirio Synergyware related software, Scanner related software, Digital cameras and Photo viewers related software, Projector related software, and PULSENSE and WristableGPS related software |
References
- https://www.epson.jp/support/misc_t/201119_oshirase.htm x_refsource_MISC
- https://www.epson.jp/support/pdf/fy20-001_softwareList_20201106_b.pdf x_refsource_MISC
- https://jvn.jp/en/jp/JVN26835001/index.html x_refsource_MISC