Vulnerability · Published Apr 11, 2023 · Assigned by jpcert
CVE-2023-27520
Medium 6.5
In plain English
A medium-severity cross-site request forgery in SEIKO EPSON printers/network interface Web Config from SEIKO EPSON CORPORATION. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Official description
Cross-site request forgery (CSRF) vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote unauthenticated attacker to hijack the authentication and perform unintended operations by having a logged-in user view a malicious page. [Note] Web Config is the software that allows users to check the status and change the settings of SEIKO EPSON printers/network interface via a web browser. According to SEIKO EPSON CORPORATION, it is also called as Remote Manager in some products. Web Config is pre-installed in some printers/network interface provided by SEIKO EPSON CORPORATION. For the details of the affected product names/model numbers, refer to the information provided by the vendor.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SEIKO EPSON CORPORATION | SEIKO EPSON printers/network interface Web Config | unspecified |
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N