PT-2018-14743 · Epson · Epson Workforce Wf-2861

Published 2018-12-24 · Updated 2020-08-24 · CVE-2018-18959

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Epson WorkForce WF-2861 versions 10.48 LQ22I3, 10.51.LQ20I6, 10.52.LQ17IA

Description An issue was discovered where the device no longer functions until a reboot when the data for 'Bonjour Service Location' at the "/PRESENTATION/BONJOUR" API endpoint is more than 251 bytes when sending data for Air Print Setting on the 'Air Print Setting' web page.

Recommendations For version 10.48 LQ22I3, avoid using the 'Air Print Setting' web page with 'Bonjour Service Location' data exceeding 251 bytes until a fix is available. For version 10.51.LQ20I6, restrict access to the "/PRESENTATION/BONJOUR" API endpoint to prevent sending large data for 'Bonjour Service Location' until a patch is released. For version 10.52.LQ17IA, consider disabling the 'Air Print Setting' feature temporarily to minimize the risk of device malfunction until the issue is resolved.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2018-18959

Affected Products

Epson Workforce Wf-2861

References · 3

• 🔥❌ https://github.com/epistemophilia/CVEs/blob/master/Epson-WorkForce-WF2861/CVE-2018-18959/poc-cve-2018-18959.py · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2018-18959 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-18959 · Security Note