CVE-2024-47295

Published: Oct 1, 2024Modified: Jun 17, 2026Deferred

8.1

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: vultures@jpcert.or.jp (Secondary)

Description

Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary password and operate the device with an administrative privilege. As for the details of the affected versions, see the information provided by the vendor under [References].

Related CWEs

CWE-1188

Initialization of a Resource with an Insecure Default

The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.

References (3)

https://epson.com/Support/wa00958

Source: vultures@jpcert.or.jp

https://jvn.jp/en/vu/JVNVU95133448/

Source: vultures@jpcert.or.jp

https://www.epson.jp/support/misc_t/240930_03_oshirase.htm

Source: vultures@jpcert.or.jp

Timeline

No history available yet.