PT-2020-17060 · Epson · Epson Eps Tse Server 8

Published 2020-12-16 · Updated 2021-07-21 · CVE-2020-28929

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EPSON EPS TSE Server 8 version 21.0.11

Description The issue allows an unauthenticated attacker to remotely retrieve administrative hashed credentials due to unrestricted access to the log downloader functionality. This can be achieved via the "maintenance/troubleshoot.php?download=1" URI.

Recommendations For EPSON EPS TSE Server 8 version 21.0.11, restrict access to the maintenance/troubleshoot.php endpoint to prevent unauthorized retrieval of administrative hashed credentials. Consider temporarily disabling the log downloader functionality until a patch is available.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-28929

Affected Products

Epson Eps Tse Server 8

References · 6

• 🔥 https://blog.bssi.fr/multiple-vulnerabilities-within-epson-eps-tse-server-8/#vulnerability-1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-28929 · Security Note
• https://osv.dev/vulnerability/CVE-2020-28929 · Vendor Advisory
• https://t.me/cvenotify/7239 · Telegram Post
• https://t.me/cibsecurity/20964 · Telegram Post
• https://t.me/cvenotify/7193 · Telegram Post