CVE-2023-27520

Vulnerability

Cross-Site Request Forgery (CSRF) vulnerability exists in Web Config (also known as Remote Manager) for SEIKO EPSON printers and network interfaces. Web Config is a built-in web-based interface for checking status and changing device settings. An unauthenticated remote attacker can leverage this flaw by having a logged-in victim access a crafted page, leading to unintended configuration changes. The vulnerability affects multiple unspecified EPSON printer and network interface models; refer to vendor advisory [1] for a full list. Fixed firmware versions are provided by EPSON [1][2].

Exploitation

An attacker must craft a malicious webpage that triggers a CSRF request to the Web Config interface. The victim must be currently authenticated to Web Config (i.e., logged in) and then visit the attacker's page. The attack can be executed remotely without any special network position; no prior authentication or write access is needed by the attacker. The user interaction required is simply viewing the malicious page while the session is active.

Impact

On successful exploitation, the attacker can perform arbitrary configuration changes on the affected printer or network interface via Web Config, but cannot directly disclose or delete information. This results in low integrity impact. The confidentiality and availability of the device are not affected (CVSS v3 base score 4.3, medium severity) [1][2]. According to the vendor [1], no attacks exploiting this vulnerability have been reported as of the advisory publication date.

Mitigation

EPSON has released firmware updates for affected products; users should update to the latest firmware version as provided on the EPSON support site [1]. The vendor announced [2] that firmware updates were scheduled for release in April 2023 and strongly recommends applying them before the respective support periods end. Workarounds are recommended by the vendor [2] but not detailed in the available references. No CVE-2023-27520 related entries are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of publication.