Vulnerability in Web Config in Printers and Network Interface Products
Thank you for using Epson products.
A vulnerability has been identified in some Epson printers and network interface products in software (Web Config*) that can check the status of the product itself or change settings on a Web browser.
* Web Config allows you to check the status of the product or change the settings by entering the IP address of the product in the URL field on a web browser such as Edge or Safari. Web Config may be referred to as Remote Manager in some products.
· Confirmed vulnerabilities
The following two vulnerabilities have been identified.
1. Cross-Site Scripting (XSS) Vulnerability
By accessing a specially crafted page, a script may be embedded in the settings of the product itself through the Web Config of the product in question.
2. Cross-Site Request Forgeries (CSRF) vulnerability
By accessing a specially crafted page, the settings of the product itself may be changed through the Web Config of the product.
· Impact of vulnerability
Currently, there are no reports of attacks exploiting this vulnerability.
· Target products and countermeasures
· Products other than the following are not affected because there are no vulnerabilities or measures have been taken at the time of shipment.
· For products that are currently on sale, we plan to release countermeasure firmware as follows. After the firmware is released, we strongly recommend that you download it from the Epson website and apply the update.
· For products that have not been supplied or are not scheduled to be supplied, we strongly recommend that you take measures by "Workaround method".
Product Name | XSS Vulnerability | CSRF Vulnerability | Countermeasure | Scheduled release |
SC-T3200 Series | Not applicable | Applicable | Apply firmware | Mid-June 2023 |
SC-T5200 Series | Not applicable | Applicable | Apply firmware | Mid-June 2023 |
SC-T7200 Series | Not applicable | Applicable | Apply firmware | Mid-June 2023 |
SC-T5200D Series | Not applicable | Applicable | Apply firmware | Mid-June 2023 |
SC-T7200D Series | Not applicable | Applicable | Apply firmware | Mid-June 2023 |
SC-P5000 Series | Not applicable | Applicable | Apply firmware | F/W Ver.: N027N2, 5 April, 2023 |
SC-P7000 Series | Not applicable | Applicable | Apply firmware | Early-July 2023 |
SC-P9000 Series | Not applicable | Applicable | Apply firmware | Early-July 2023 |
SC-P6000 Series | Not applicable | Applicable | Apply firmware | Early-July 2023 |
SC-P8000 Series | Not applicable | Applicable | Apply firmware | Early-July 2023 |
SC-P20000 Series | Not applicable | Applicable | Apply firmware | Mid-July 2023 |
SC-S80600 Series | Not applicable | Applicable | Apply firmware | F/W Ver.: SA011MB, 31 March, 2023 |
SC-S60600 Series | Not applicable | Applicable | Apply firmware | F/W Ver.: HA027K2, 31 March, 2023 |
SC-S40600 Series | Not applicable | Applicable | Apply firmware | F/W Ver.: BA027K2, 30 March, 2023 |
SC-S60600L Series | Not applicable | Applicable | Apply firmware | F/W Ver.: HC001LA, 31 March, 2023 |
SC-S80600L Series | Not applicable | Applicable | Apply firmware | F/W Ver.: SC024M3, 31 March, 2023 |
SC-F7200 Series | Not applicable | Applicable | Apply firmware | F/W Ver.: CO011LA, 31 March, 2023 |
SC-F6300 Series | Not applicable | Applicable | Apply firmware | Late-September 2023 |
SC-F9400 Series | Not applicable | Applicable | Apply firmware | F/W Ver.: MT026L5, 31 March, 2023 |
SC-F9400H Series | Not applicable | Applicable | Apply firmware | F/W Ver.: MU026L5, 31 March, 2023 |
SC-F2100 Series | Not applicable | Applicable | Apply firmware | Early-August 2023 |
TM-C7500 | Not applicable | Applicable | Apply firmware | F/W Ver.: WAI34400, 27 March, 2023 |
TM-C3500 | Not applicable | Applicable | Apply firmware | F/W Ver.: WAM32500, 27 March, 2023 |
TM-C3400 | Not applicable | Applicable | Workaround | ― |
TM-C610 | Not applicable | Applicable | Workaround | ― |
PX-B510 | Not applicable | Applicable | Workaround | ― |
PX-B500 | Not applicable | Applicable | Workaround | ― |
StylusPro3800 | Not applicable | Applicable | Workaround | ― |
StylusPro3800C | Not applicable | Applicable | Workaround | ― |
StylusPro3850 | Not applicable | Applicable | Workaround | ― |
StylusPro3880 | Not applicable | Applicable | Workaround | ― |
StylusPro3885 | Not applicable | Applicable | Workaround | ― |
StylusPro3890 | Not applicable | Applicable | Workaround | ― |
StylusPhotoR3000 | Not applicable | Applicable | Workaround | ― |
StylusPhotoR2000 | Not applicable | Applicable | Workaround | ― |
SC-P400 Series | Not applicable | Applicable | Workaround | ― |
SC-P600 Series | Not applicable | Applicable | Workaround | ― |
SC-P800 Series | Not applicable | Applicable | Workaround | ― |
StylusPro4450 | Not applicable | Applicable | Workaround | ― |
StylusPro4880 | Not applicable | Applicable | Workaround | ― |
StylusPro4880C | Not applicable | Applicable | Workaround | ― |
StylusPro7450 | Not applicable | Applicable | Workaround | ― |
StylusPro7880 | Not applicable | Applicable | Workaround | ― |
StylusPro7880C | Not applicable | Applicable | Workaround | ― |
StylusPro9450 | Not applicable | Applicable | Workaround | ― |
StylusPro9880 | Not applicable | Applicable | Workaround | ― |
StylusPro9880C | Not applicable | Applicable | Workaround | ― |
StylusPro11880 | Not applicable | Applicable | Workaround | ― |
StylusPro11880C | Not applicable | Applicable | Workaround | ― |
StylusProGS6000 | Not applicable | Applicable | Workaround | ― |
StylusProWT7900 | Not applicable | Applicable | Workaround | ― |
StylusProWT7910 | Not applicable | Applicable | Workaround | ― |
StylusPro7700 | Not applicable | Applicable | Workaround | ― |
StylusPro7710 | Not applicable | Applicable | Workaround | ― |
StylusPro7700M | Not applicable | Applicable | Workaround | ― |
StylusPro7710M | Not applicable | Applicable | Workaround | ― |
StylusPro9700 | Not applicable | Applicable | Workaround | ― |
StylusPro9710 | Not applicable | Applicable | Workaround | ― |
StylusPro4900 | Not applicable | Applicable | Workaround | ― |
StylusPro4910 | Not applicable | Applicable | Workaround | ― |
StylusPro7890 | Not applicable | Applicable | Workaround | ― |
StylusPro7908 | Not applicable | Applicable | Workaround | ― |
StylusPro7900 | Not applicable | Applicable | Workaround | ― |
StylusPro7910 | Not applicable | Applicable | Workaround | ― |
StylusPro9890 | Not applicable | Applicable | Workaround | ― |
StylusPro9908 | Not applicable | Applicable | Workaround | ― |
StylusPro9900 | Not applicable | Applicable | Workaround | ― |
StylusPro9910 | Not applicable | Applicable | Workaround | ― |
SC-T3000 Series | Not applicable | Applicable | Workaround | ― |
SC-T5000 Series | Not applicable | Applicable | Workaround | ― |
SC-T7000 Series | Not applicable | Applicable | Workaround | ― |
SC-P10000 Series | Not applicable | Applicable | Workaround | ― |
SC-S30600 Series | Not applicable | Applicable | Workaround | ― |
SC-S50600 Series | Not applicable | Applicable | Workaround | ― |
SC-S70600 Series | Not applicable | Applicable | Workaround | ― |
SC-F6000 Series | Not applicable | Applicable | Workaround | ― |
SC-F7000 Series | Not applicable | Applicable | Workaround | ― |
SC-F7100 Series | Not applicable | Applicable | Workaround | ― |
SC-F6200 Series | Not applicable | Applicable | Workaround | ― |
SC-F9200 Series | Not applicable | Applicable | Workaround | ― |
SC-F9300 Series | Not applicable | Applicable | Workaround | ― |
SC-F2000 Series | Not applicable | Applicable | Workaround | ― |
StylusPro9860 | Not applicable | Applicable | Workaround | ― |
StylusPro9906D | Not applicable | Applicable | Workaround | ― |
SC-B7000 Series | Not applicable | Applicable | Workaround | ― |
AcuLaser 2600N | Applicable | Applicable | Workaround | ― |
AcuLaser C1900 | Applicable | Applicable | Workaround | ― |
AcuLaser C2000 | Applicable | Applicable | Workaround | ― |
AcuLaser C2600N | Applicable | Applicable | Workaround | ― |
AcuLaser C2800DN | Applicable | Applicable | Workaround | ― |
AcuLaser C2800N | Applicable | Applicable | Workaround | ― |
AcuLaser C3800DN | Applicable | Applicable | Workaround | ― |
AcuLaser C3800N | Applicable | Applicable | Workaround | ― |
AcuLaser C4000 | Applicable | Applicable | Workaround | ― |
AcuLaser C4100 | Applicable | Applicable | Workaround | ― |
AcuLaser C4200DN | Applicable | Applicable | Workaround | ― |
AcuLaser C8500 | Applicable | Applicable | Workaround | ― |
AcuLaser C9000 | Applicable | Applicable | Workaround | ― |
AcuLaser C9100 | Applicable | Applicable | Workaround | ― |
AcuLaser C9200N | Applicable | Applicable | Workaround | ― |
AcuLaser C9300N | Applicable | Applicable | Workaround | ― |
AcuLaser CX28DN | Applicable | Applicable | Workaround | ― |
AcuLaser M2000DN | Applicable | Applicable | Workaround | ― |
AcuLaser M2010DN | Applicable | Applicable | Workaround | ― |
AcuLaser M2300DN | Applicable | Applicable | Workaround | ― |
AcuLaser M2310DN | Applicable | Applicable | Workaround | ― |
AcuLaser M2400DN | Applicable | Applicable | Workaround | ― |
AcuLaser M2410DN | Applicable | Applicable | Workaround | ― |
AcuLaser M4000N | Applicable | Applicable | Workaround | ― |
AcuLaser M7000N | Applicable | Applicable | Workaround | ― |
AcuLaser M8000N | Applicable | Applicable | Workaround | ― |
AcuLaser MX20DN | Applicable | Applicable | Workaround | ― |
AcuLaser MX21DNF | Applicable | Applicable | Workaround | ― |
AL-C500DN | Applicable | Applicable | Workaround | ― |
EPL-5700 | Applicable | Applicable | Workaround | ― |
EPL-C8200 | Applicable | Applicable | Workaround | ― |
EPL-N2000 | Applicable | Applicable | Workaround | ― |
EPL-N2000K | Applicable | Applicable | Workaround | ― |
EPL-N2050 | Applicable | Applicable | Workaround | ― |
EPL-N2050+ | Applicable | Applicable | Workaround | ― |
EPL-N2700 | Applicable | Applicable | Workaround | ― |
EPL-N2750 | Applicable | Applicable | Workaround | ― |
EPL-N3000 | Applicable | Applicable | Workaround | ― |
EPL-N4000 | Applicable | Applicable | Workaround | ― |
EPL-N4000+ | Applicable | Applicable | Workaround | ― |
EPL-N7000 | Applicable | Applicable | Workaround | ― |
EpsonNet 10/100 Base TX USB Print Server (C82402*) | Applicable | Applicable | Workaround | ― |
EpsonNet 10/100 Base TX USB Print Server (C82403*) | Applicable | Applicable | Workaround | ― |
EpsonNet 10/100 Base Tx High Speed Int.Print Server (C82405*) | Applicable | Applicable | Workaround | ― |
EpsonNet 802.11g wireless Ext. Print Server (C82422*) | Applicable | Applicable | Workaround | ― |
EpsonNet 10/100 Base Tx Int. Print Server 5 (C82434*) | Applicable | Applicable | Workaround | ― |
EpsonNet 10/100 Base Tx Int. Print Server 5e (C82435*) | Applicable | Applicable | Workaround | ― |
EpsonNet 802.11b/g Wireless and 10/100 Base Tx Ext. Print Server | Applicable | Applicable | Workaround | ― |
EpsonNet Authentication Print | Applicable | Applicable | Workaround | ― |
EpsonNet 10 Base 2/T Int. Print Server (C82362*) | Applicable | Applicable | Workaround | ― |
EpsonNet 10/100 Base Tx Ext. Print Server (C82363*) | Applicable | Applicable | Workaround | ― |
EpsonNet 10/100 Base Tx Ext. Print Server (C82364*) | Applicable | Applicable | Workaround | ― |
EpsonNet 10/100 Base Tx External Print Server (C82378*) | Applicable | Applicable | Workaround | ― |
EpsonNet 10/100 Base Tx Int. Print Server (C82384*) | Applicable | Applicable | Workaround | ― |
EpsonNet 10/100 Base Tx Int―. Print Server 2 (C82391*) | Applicable | Applicable | Workaround | ― |
EpsonNet 802.11b Wireless Ext. Print Server (C82396*) | Applicable | Applicable | Workaround | ― |
EpsonNet 802.11b Wireless Ext. Print Server (C82397*) | Applicable | Applicable | Workaround | ― |
EpsonNet 802.11b Wireless Ext. Print Server (C82398*) | Applicable | Applicable | Workaround | ― |
EPSON Network Image Express | Applicable | Applicable | Workaround | ― |
EPSON Network Image Express Card (B80839*) | Applicable | Applicable | Workaround | - |
· Workaround method
In order for customers to use the product safely and securely, please install and configure it according to the security guidebook.
· Installation and configuration according to the security guidebook
1. Connecting to the Internet
The product should not be directly connected to the Internet and should be installed in a network protected by a firewall. In that case, please set a private IP address and operate.
2. Administrator password
Set an administrator password for each product.
The administrator password should be a complex string that is difficult for others to guess, such as mixing not only English characters but also symbols and numbers to make it 8 characters or more.
Please check the Security Guidebook here.
· Stronger workaround – Block HTTP (TCP/80 port) access to the product
1. Blocked by product
For the following products, you can block HTTP access (TCP/80 port) in Web Config.
· Business Printer: AcuLaser C9300N/ AcuLaser M7000N
· Commercial & Industrial Printers: SC-T3200 Series/SC-T5200 Series/SC-T7200 Series/SC-T5200D Series/SC-T7200D Series
2. Shut off by network equipment in the installation environment
After configuring the product, block HTTP access (TCP/80 port) to the product with a network device (router or switch). Open the port only when you need to update the application settings or firmware.
* Due to blockage, the functions in Web Config may not be available.