jvndb - jvndb-2025-004079

JVNDB-2025-004079

Vulnerability from jvndb - Published: 2025-04-30 11:46 - Updated:2025-04-30 11:46

Severity ?

7.8 (High) - cvssV3_0 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

Improper access permission settings in multiple SEIKO EPSON printer drivers for Windows OS

Details

Multiple SEIKO EPSON printer drivers for Windows OS are configured with an improper access permission settings when installed or used in a language other than English. * Incorrect default permissions (CWE-276) - CVE-2025-42598 Private security researcher Erkan Ekici reported this vulnerability to the developer and coordinated. The developer and JPCERT/CC published respective advisories in order to notify users of this vulnerability.

References

Type

URL

	JVN	https://jvn.jp/en/vu/JVNVU90649144/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-42598
	Incorrect Default Permissions(CWE-276)	https://cwe.mitre.org/data/definitions/276.html

Impacted products

Vendor

Product

SEIKO EPSON CORPORATION

(Multiple Products)

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-004079.html",
  "dc:date": "2025-04-30T11:46+09:00",
  "dcterms:issued": "2025-04-30T11:46+09:00",
  "dcterms:modified": "2025-04-30T11:46+09:00",
  "description": "Multiple SEIKO EPSON printer drivers for Windows OS are configured with an improper access permission settings when installed or used in a language other than English.\r\n\r\n* Incorrect default permissions (CWE-276) - CVE-2025-42598\r\n\r\nPrivate security researcher Erkan Ekici reported this vulnerability to the developer and coordinated. The developer and JPCERT/CC published respective advisories in order to notify users of this vulnerability.",
  "link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-004079.html",
  "sec:cpe": {
    "#text": "cpe:/a:epson:multiple_product",
    "@product": "(Multiple Products)",
    "@vendor": "SEIKO EPSON CORPORATION",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "7.8",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2025-004079",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU90649144/index.html",
      "@id": "JVNVU#90649144",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-42598",
      "@id": "CVE-2025-42598",
      "@source": "CVE"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/276.html",
      "@id": "CWE-276",
      "@title": "Incorrect Default Permissions(CWE-276)"
    }
  ],
  "title": "Improper access permission settings in multiple SEIKO EPSON printer drivers for Windows OS"
}

CVE-2025-42598 (GCVE-0-2025-42598)

Vulnerability from cvelistv5 – Published: 2025-04-28 08:20 – Updated: 2025-04-28 16:10

Summary

Multiple SEIKO EPSON printer drivers for Windows OS are configured with an improper access permission settings when installed or used in a language other than English. If a user is directed to place a crafted DLL file in a location of an attacker's choosing, the attacker may execute arbitrary code with SYSTEM privilege on a Windows system on which the printer driver is installed.

Severity ?

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.4 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-276 - Incorrect default permissions

Assigner

jpcert

References

URL

Tags

	https://www.epson.co.uk/en_GB/faq/KA-01993/conten…
	https://www.epson.jp/support/misc_t/250428_oshirase.htm
	https://www2.epson.jp/support/misc_t/windrv_produ…
	https://jvn.jp/en/vu/JVNVU90649144/

Impacted products

	Vendor	Product	Version
	SEIKO EPSON CORPORATION	SEIKO EPSON printer drivers for Windows OS	Affected: see the information provided by SEIKO EPSON CORPORATION.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-42598",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-28T16:06:33.551722Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-28T16:10:51.558Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SEIKO EPSON printer drivers for Windows OS",
          "vendor": "SEIKO EPSON CORPORATION",
          "versions": [
            {
              "status": "affected",
              "version": "see the information provided by SEIKO EPSON CORPORATION."
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple SEIKO EPSON printer drivers for Windows OS are configured with an improper access permission settings when installed or used in a language other than English. If a user is directed to place a crafted DLL file in a location of an attacker\u0027s choosing, the attacker may execute arbitrary code with SYSTEM privilege on a Windows system on which the printer driver is installed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-276",
              "description": "Incorrect default permissions",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-28T08:20:56.756Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.epson.co.uk/en_GB/faq/KA-01993/contents?loc=en-us"
        },
        {
          "url": "https://www.epson.jp/support/misc_t/250428_oshirase.htm"
        },
        {
          "url": "https://www2.epson.jp/support/misc_t/windrv_productlist.pdf"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU90649144/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-42598",
    "datePublished": "2025-04-28T08:20:56.756Z",
    "dateReserved": "2025-04-16T11:56:26.983Z",
    "dateUpdated": "2025-04-28T16:10:51.558Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

JVNDB-2025-004079

CVE-2025-42598 (GCVE-0-2025-42598)

Tags

Sightings

Nomenclature