cvelistv5 - cve-2024-47295

cve-2024-47295

Vulnerability from cvelistv5

Published

2024-10-01 03:16

Modified

2024-11-11 07:15

Severity ?

8.1 (High) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary password and operate the device with an administrative privilege. As for the details of the affected versions, see the information provided by the vendor under [References].

References

▼	URL	Tags
	vultures@jpcert.or.jp	https://epson.com/Support/wa00958
	vultures@jpcert.or.jp	https://jvn.jp/en/vu/JVNVU95133448/
	vultures@jpcert.or.jp	https://www.epson.jp/support/misc_t/240930_03_oshirase.htm

Impacted products

▼	Vendor	Product
	SEIKO EPSON CORPORATION	Web Config

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:seiko_epson_corporation:web_config:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "web_config",
            "vendor": "seiko_epson_corporation",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-47295",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-01T14:01:15.326202Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-01T14:01:18.787Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Web Config",
          "vendor": "SEIKO EPSON CORPORATION",
          "versions": [
            {
              "status": "affected",
              "version": "See the information/details provided by the vendor"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary password and operate the device with an administrative privilege. As for the details of the affected versions, see the information provided by the vendor under [References]."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1188",
              "description": "Initialization of a resource with an insecure default",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-11T07:15:21.646Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://epson.com/Support/wa00958"
        },
        {
          "url": "https://www.epson.jp/support/misc_t/240930_03_oshirase.htm"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU95133448/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-47295",
    "datePublished": "2024-10-01T03:16:40.052Z",
    "dateReserved": "2024-09-24T08:32:15.357Z",
    "dateUpdated": "2024-11-11T07:15:21.646Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-47295\",\"sourceIdentifier\":\"vultures@jpcert.or.jp\",\"published\":\"2024-10-01T04:15:18.040\",\"lastModified\":\"2024-11-11T08:15:09.423\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary password and operate the device with an administrative privilege. As for the details of the affected versions, see the information provided by the vendor under [References].\"},{\"lang\":\"es\",\"value\":\"Un problema de configuraci\u00f3n de contrase\u00f1a inicial insegura en SEIKO EPSON Web Config permite que un atacante remoto no autenticado establezca una contrase\u00f1a arbitraria y opere el dispositivo con privilegios administrativos. Para conocer los detalles de las versiones afectadas, consulte la informaci\u00f3n proporcionada por el proveedor en [Referencias].\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}],\"cvssMetricV30\":[{\"source\":\"vultures@jpcert.or.jp\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"vultures@jpcert.or.jp\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1188\"}]}],\"references\":[{\"url\":\"https://epson.com/Support/wa00958\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://jvn.jp/en/vu/JVNVU95133448/\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://www.epson.jp/support/misc_t/240930_03_oshirase.htm\",\"source\":\"vultures@jpcert.or.jp\"}]}}"
  }
}

cve-2024-47295

Vulnerability from jvndb

Published

2024-10-01 14:14

Modified

2024-11-12 10:25

Severity ?

8.1 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

Insecure initial password configuration issue in SEIKO EPSON Web Config

Details

Web Config is software that allows users to check the status and change the settings of SEIKO EPSON products, e.g., printers and scanners, via a web browser. In the initial setting no administrative password is set, and when a user connects the device and configures Web Config settings for the first time, the user is requested to set the password. Therefore, when a product is connected to network without the Web Config settings configured, arbitrary password may be set and the device may be operated with an administrative privilege by an attacker (CWE-1188). George Puckett reported this vulnerability to CERT/CC. Requested by CERT/CC, JPCERT/CC coordinated with the developer.

References

▼	Type	URL
	JVN	https://jvn.jp/en/vu/JVNVU95133448/index.html
	CVE	https://www.cve.org/CVERecord?id= CVE-2024-47295
	Insecure Default Initialization of Resource(CWE-1188)	https://cwe.mitre.org/data/definitions/1188.html

Impacted products

▼	Vendor	Product
	SEIKO EPSON CORPORATION	Web Config

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-009481.html",
  "dc:date": "2024-11-12T10:25+09:00",
  "dcterms:issued": "2024-10-01T14:14+09:00",
  "dcterms:modified": "2024-11-12T10:25+09:00",
  "description": "Web Config is software that allows users to check the status and change the settings of SEIKO EPSON products, e.g., printers and scanners, via a web browser. In the initial setting no administrative password is set, and when a user connects the device and configures Web Config settings for the first time, the user is requested to set the password.\r\nTherefore, when a product is connected to network without the Web Config settings configured, arbitrary password may be set and the device may be operated with an administrative privilege by an attacker (CWE-1188).\r\n\r\nGeorge Puckett reported this vulnerability to CERT/CC.\r\nRequested by CERT/CC, JPCERT/CC coordinated with the developer.",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-009481.html",
  "sec:cpe": {
    "#text": "cpe:/a:epson:web_config",
    "@product": "Web Config",
    "@vendor": "SEIKO EPSON CORPORATION",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "8.1",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2024-009481",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU95133448/index.html",
      "@id": "JVNVU#95133448",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=\tCVE-2024-47295",
      "@id": "CVE-2024-47295",
      "@source": "CVE"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/1188.html",
      "@id": "CWE-1188",
      "@title": "Insecure Default Initialization of Resource(CWE-1188)"
    }
  ],
  "title": "Insecure initial password configuration issue in SEIKO EPSON Web Config"
}

ghsa-x2wv-q3cc-vc36

Vulnerability from github

Published

2024-10-01 06:30

Modified

2024-11-11 09:30

Severity ?

8.1 (High) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-47295"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-01T04:15:18Z",
    "severity": "HIGH"
  },
  "details": "Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary password and operate the device with an administrative privilege. As for the details of the affected versions, see the information provided by the vendor under [References].",
  "id": "GHSA-x2wv-q3cc-vc36",
  "modified": "2024-11-11T09:30:41Z",
  "published": "2024-10-01T06:30:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47295"
    },
    {
      "type": "WEB",
      "url": "https://epson.com/Support/wa00958"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/vu/JVNVU95133448"
    },
    {
      "type": "WEB",
      "url": "https://www.epson.jp/support/misc_t/240930_03_oshirase.htm"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

cve-2024-47295

Vulnerability from cvelistv5

cve-2024-47295

Vulnerability from jvndb

ghsa-x2wv-q3cc-vc36

Vulnerability from github

Tags

Sightings

Nomenclature