cvelistv5 - cve-2024-47295

CVE-2024-47295 (GCVE-0-2024-47295)

Vulnerability from cvelistv5 – Published: 2024-10-01 03:16 – Updated: 2024-11-11 07:15

Summary

Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary password and operate the device with an administrative privilege. As for the details of the affected versions, see the information provided by the vendor under [References].

Severity ?

8.1 (High)


                        
                          CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-1188 - Initialization of a resource with an insecure default

Assigner

jpcert

References

URL

Tags

	https://epson.com/Support/wa00958
	https://www.epson.jp/support/misc_t/240930_03_osh…
	https://jvn.jp/en/vu/JVNVU95133448/

Impacted products

	Vendor	Product	Version
	SEIKO EPSON CORPORATION	Web Config	Affected: See the information/details provided by the vendor

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:seiko_epson_corporation:web_config:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "web_config",
            "vendor": "seiko_epson_corporation",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-47295",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-01T14:01:15.326202Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-01T14:01:18.787Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Web Config",
          "vendor": "SEIKO EPSON CORPORATION",
          "versions": [
            {
              "status": "affected",
              "version": "See the information/details provided by the vendor"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary password and operate the device with an administrative privilege. As for the details of the affected versions, see the information provided by the vendor under [References]."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1188",
              "description": "Initialization of a resource with an insecure default",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-11T07:15:21.646Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://epson.com/Support/wa00958"
        },
        {
          "url": "https://www.epson.jp/support/misc_t/240930_03_oshirase.htm"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU95133448/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-47295",
    "datePublished": "2024-10-01T03:16:40.052Z",
    "dateReserved": "2024-09-24T08:32:15.357Z",
    "dateUpdated": "2024-11-11T07:15:21.646Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary password and operate the device with an administrative privilege. As for the details of the affected versions, see the information provided by the vendor under [References].\"}, {\"lang\": \"es\", \"value\": \"Un problema de configuraci\\u00f3n de contrase\\u00f1a inicial insegura en SEIKO EPSON Web Config permite que un atacante remoto no autenticado establezca una contrase\\u00f1a arbitraria y opere el dispositivo con privilegios administrativos. Para conocer los detalles de las versiones afectadas, consulte la informaci\\u00f3n proporcionada por el proveedor en [Referencias].\"}]",
      "id": "CVE-2024-47295",
      "lastModified": "2024-11-11T08:15:09.423",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 5.9}], \"cvssMetricV30\": [{\"source\": \"vultures@jpcert.or.jp\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 5.9}]}",
      "published": "2024-10-01T04:15:18.040",
      "references": "[{\"url\": \"https://epson.com/Support/wa00958\", \"source\": \"vultures@jpcert.or.jp\"}, {\"url\": \"https://jvn.jp/en/vu/JVNVU95133448/\", \"source\": \"vultures@jpcert.or.jp\"}, {\"url\": \"https://www.epson.jp/support/misc_t/240930_03_oshirase.htm\", \"source\": \"vultures@jpcert.or.jp\"}]",
      "sourceIdentifier": "vultures@jpcert.or.jp",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"vultures@jpcert.or.jp\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-1188\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-47295\",\"sourceIdentifier\":\"vultures@jpcert.or.jp\",\"published\":\"2024-10-01T04:15:18.040\",\"lastModified\":\"2024-11-11T08:15:09.423\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary password and operate the device with an administrative privilege. As for the details of the affected versions, see the information provided by the vendor under [References].\"},{\"lang\":\"es\",\"value\":\"Un problema de configuraci\u00f3n de contrase\u00f1a inicial insegura en SEIKO EPSON Web Config permite que un atacante remoto no autenticado establezca una contrase\u00f1a arbitraria y opere el dispositivo con privilegios administrativos. Para conocer los detalles de las versiones afectadas, consulte la informaci\u00f3n proporcionada por el proveedor en [Referencias].\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}],\"cvssMetricV30\":[{\"source\":\"vultures@jpcert.or.jp\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"vultures@jpcert.or.jp\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1188\"}]}],\"references\":[{\"url\":\"https://epson.com/Support/wa00958\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://jvn.jp/en/vu/JVNVU95133448/\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://www.epson.jp/support/misc_t/240930_03_oshirase.htm\",\"source\":\"vultures@jpcert.or.jp\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47295\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-01T14:01:15.326202Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:seiko_epson_corporation:web_config:*:*:*:*:*:*:*:*\"], \"vendor\": \"seiko_epson_corporation\", \"product\": \"web_config\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-01T14:01:03.128Z\"}}], \"cna\": {\"metrics\": [{\"format\": \"CVSS\", \"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en-US\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"SEIKO EPSON CORPORATION\", \"product\": \"Web Config\", \"versions\": [{\"status\": \"affected\", \"version\": \"See the information/details provided by the vendor\"}]}], \"references\": [{\"url\": \"https://epson.com/Support/wa00958\"}, {\"url\": \"https://www.epson.jp/support/misc_t/240930_03_oshirase.htm\"}, {\"url\": \"https://jvn.jp/en/vu/JVNVU95133448/\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary password and operate the device with an administrative privilege. As for the details of the affected versions, see the information provided by the vendor under [References].\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en-US\", \"type\": \"CWE\", \"cweId\": \"CWE-1188\", \"description\": \"Initialization of a resource with an insecure default\"}]}], \"providerMetadata\": {\"orgId\": \"ede6fdc4-6654-4307-a26d-3331c018e2ce\", \"shortName\": \"jpcert\", \"dateUpdated\": \"2024-11-11T07:15:21.646Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47295\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-11T07:15:21.646Z\", \"dateReserved\": \"2024-09-24T08:32:15.357Z\", \"assignerOrgId\": \"ede6fdc4-6654-4307-a26d-3331c018e2ce\", \"datePublished\": \"2024-10-01T03:16:40.052Z\", \"assignerShortName\": \"jpcert\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-X2WV-Q3CC-VC36

Vulnerability from github – Published: 2024-10-01 06:30 – Updated: 2024-11-11 09:30

Details

Severity ?

8.1 (High)


                  
                    CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-47295"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-01T04:15:18Z",
    "severity": "HIGH"
  },
  "details": "Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary password and operate the device with an administrative privilege. As for the details of the affected versions, see the information provided by the vendor under [References].",
  "id": "GHSA-x2wv-q3cc-vc36",
  "modified": "2024-11-11T09:30:41Z",
  "published": "2024-10-01T06:30:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47295"
    },
    {
      "type": "WEB",
      "url": "https://epson.com/Support/wa00958"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/vu/JVNVU95133448"
    },
    {
      "type": "WEB",
      "url": "https://www.epson.jp/support/misc_t/240930_03_oshirase.htm"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

WID-SEC-W-2024-3372

Vulnerability from csaf_certbund - Published: 2024-11-07 23:00 - Updated: 2024-11-07 23:00

Summary

Epson Printer: Schwachstelle ermöglicht Übernahme der Kontrolle

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Epson bietet Drucker für verschiedene Anwendungsbereiche.

Angriff

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Epson Printer ausnutzen, um die Kontrolle über das Gerät zu übernehmen.

Betroffene Betriebssysteme

- Sonstiges

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Epson bietet Drucker f\u00fcr verschiedene Anwendungsbereiche.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Epson Printer ausnutzen, um die Kontrolle \u00fcber das Ger\u00e4t zu \u00fcbernehmen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-3372 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3372.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-3372 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3372"
      },
      {
        "category": "external",
        "summary": "Epson Security Advisory vom 2024-11-07",
        "url": "https://epson.com/Support/wa00958"
      }
    ],
    "source_lang": "en-US",
    "title": "Epson Printer: Schwachstelle erm\u00f6glicht \u00dcbernahme der Kontrolle",
    "tracking": {
      "current_release_date": "2024-11-07T23:00:00.000+00:00",
      "generator": {
        "date": "2024-11-08T10:03:32.864+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.8"
        }
      },
      "id": "WID-SEC-W-2024-3372",
      "initial_release_date": "2024-11-07T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-11-07T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "WebConfig",
                "product": {
                  "name": "Epson Printer WebConfig",
                  "product_id": "T038850",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:epson:printer:webconfig"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Printer"
          }
        ],
        "category": "vendor",
        "name": "Epson"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-47295",
      "notes": [
        {
          "category": "description",
          "text": "In verschiedenen Epson-Druckern gibt es eine Schwachstelle. In den Werkseinstellungen ist das Administratorkennwort leer. Wenn bei der Installation kein Kennwort festgelegt wurde, kann ein entfernter, anonymer Angreifer dies \u00fcber die Webkonfigurationsschnittstelle ausnutzen und die Kontrolle \u00fcber das Ger\u00e4t \u00fcbernehmen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T038850"
        ]
      },
      "release_date": "2024-11-07T23:00:00.000+00:00",
      "title": "CVE-2024-47295"
    }
  ]
}

FKIE_CVE-2024-47295

Vulnerability from fkie_nvd - Published: 2024-10-01 04:15 - Updated: 2024-11-11 08:15

Severity ?

8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	vultures@jpcert.or.jp	https://epson.com/Support/wa00958
	vultures@jpcert.or.jp	https://jvn.jp/en/vu/JVNVU95133448/
	vultures@jpcert.or.jp	https://www.epson.jp/support/misc_t/240930_03_oshirase.htm

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary password and operate the device with an administrative privilege. As for the details of the affected versions, see the information provided by the vendor under [References]."
    },
    {
      "lang": "es",
      "value": "Un problema de configuraci\u00f3n de contrase\u00f1a inicial insegura en SEIKO EPSON Web Config permite que un atacante remoto no autenticado establezca una contrase\u00f1a arbitraria y opere el dispositivo con privilegios administrativos. Para conocer los detalles de las versiones afectadas, consulte la informaci\u00f3n proporcionada por el proveedor en [Referencias]."
    }
  ],
  "id": "CVE-2024-47295",
  "lastModified": "2024-11-11T08:15:09.423",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9,
        "source": "vultures@jpcert.or.jp",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-10-01T04:15:18.040",
  "references": [
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://epson.com/Support/wa00958"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://jvn.jp/en/vu/JVNVU95133448/"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://www.epson.jp/support/misc_t/240930_03_oshirase.htm"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1188"
        }
      ],
      "source": "vultures@jpcert.or.jp",
      "type": "Secondary"
    }
  ]
}

JVNDB-2024-009481

Vulnerability from jvndb - Published: 2024-10-01 14:14 - Updated:2024-11-12 10:25

Severity ?

8.1 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

Insecure initial password configuration issue in SEIKO EPSON Web Config

Details

Web Config is software that allows users to check the status and change the settings of SEIKO EPSON products, e.g., printers and scanners, via a web browser. In the initial setting no administrative password is set, and when a user connects the device and configures Web Config settings for the first time, the user is requested to set the password. Therefore, when a product is connected to network without the Web Config settings configured, arbitrary password may be set and the device may be operated with an administrative privilege by an attacker (CWE-1188). George Puckett reported this vulnerability to CERT/CC. Requested by CERT/CC, JPCERT/CC coordinated with the developer.

References

Type

URL

	JVN	https://jvn.jp/en/vu/JVNVU95133448/index.html
	CVE	https://www.cve.org/CVERecord?id= CVE-2024-47295
	Insecure Default Initialization of Resource(CWE-1188)	https://cwe.mitre.org/data/definitions/1188.html

Impacted products

Vendor

Product

SEIKO EPSON CORPORATION

Web Config

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-009481.html",
  "dc:date": "2024-11-12T10:25+09:00",
  "dcterms:issued": "2024-10-01T14:14+09:00",
  "dcterms:modified": "2024-11-12T10:25+09:00",
  "description": "Web Config is software that allows users to check the status and change the settings of SEIKO EPSON products, e.g., printers and scanners, via a web browser. In the initial setting no administrative password is set, and when a user connects the device and configures Web Config settings for the first time, the user is requested to set the password.\r\nTherefore, when a product is connected to network without the Web Config settings configured, arbitrary password may be set and the device may be operated with an administrative privilege by an attacker (CWE-1188).\r\n\r\nGeorge Puckett reported this vulnerability to CERT/CC.\r\nRequested by CERT/CC, JPCERT/CC coordinated with the developer.",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-009481.html",
  "sec:cpe": {
    "#text": "cpe:/a:epson:web_config",
    "@product": "Web Config",
    "@vendor": "SEIKO EPSON CORPORATION",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "8.1",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2024-009481",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU95133448/index.html",
      "@id": "JVNVU#95133448",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=\tCVE-2024-47295",
      "@id": "CVE-2024-47295",
      "@source": "CVE"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/1188.html",
      "@id": "CWE-1188",
      "@title": "Insecure Default Initialization of Resource(CWE-1188)"
    }
  ],
  "title": "Insecure initial password configuration issue in SEIKO EPSON Web Config"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-47295 (GCVE-0-2024-47295)

GHSA-X2WV-Q3CC-VC36

WID-SEC-W-2024-3372

FKIE_CVE-2024-47295

JVNDB-2024-009481

Tags

Sightings

Nomenclature