JVNDB-2024-009481

Insecure initial password configuration issue in SEIKO EPSON Web Config

Web Config is software that allows users to check the status and change the settings of SEIKO EPSON products, e.g., printers and scanners, via a web browser. In the initial setting no administrative password is set, and when a user connects the device and configures Web Config settings for the first time, the user is requested to set the password.
Therefore, when a product is connected to network without the Web Config settings configured, arbitrary password may be set and the device may be operated with an administrative privilege by an attacker (CWE-1188).

George Puckett reported this vulnerability to CERT/CC.
Requested by CERT/CC, JPCERT/CC coordinated with the developer.

SEIKO EPSON CORPORATION

• Web Config

For the information of the affected devices, please refer to the information (in Japanese) provided by the developer.

When the product is connected to network without the Web Config settings configured, an arbitrary password may be set and the product may be operated with an administrative privilege by an attacker.

[Apply the workaround]
Applying the following workaround may mitigate the impact of this vulnerability.
* Set the administrative password
In the section 3 of developer's Security Guidebook,it is strongly recommended to set the administrative password when installing product.

SEIKO EPSON CORPORATION

• SEIKO EPSON CORPORATION : Security Guidebook
• SEIKO EPSON CORPORATION : Insecure Initial Password Configuration in Epson WebConfig Vulnerability

1. Insecure Default Initialization of Resource(CWE-1188) [Other]

1. CVE-2024-47295

1. JVN : JVNVU#95133448

• [2024/10/01]
    Web page was published
• [2024/11/12]
    Vendor Information : Content was modified