Vulnerability · Published May 22, 2020 · Assigned by talos

CVE-2020-6091

Critical 9.8

In plain English

A critical-severity authentication bypass in Epson. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities).

Severity (CVSS 3.0)9.8Critical

Exploit odds (30 days)2.4%top 16.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An exploitable authentication bypass vulnerability exists in the ESPON Web Control functionality of Epson EB-1470Ui MAIN: 98009273ESWWV107 MAIN2: 8X7325WWV303. A specially crafted series of HTTP requests can cause authentication bypass resulting in information disclosure. An attacker can send an HTTP request to trigger this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
n/a	Epson	Epson EB-1470Ui MAIN: 98009273ESWWV107 MAIN2: 8X7325WWV303

Weakness: CWE-288 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://talosintelligence.com/vulnerability_reports/TALOS-2020-1011 x_refsource_MISC
https://epson.com/support/wa00907 x_refsource_CONFIRM