PT-2021-12821 · Epson · Epson Iprojection

Published 2021-02-05 · Updated 2023-02-03 · CVE-2020-9014

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Epson iProjection version 2.30

Description: The driver file EMP NSAU.sys in Epson iProjection allows local users to cause a denial of service (BSOD) via crafted input to the virtual audio device driver with IOCTL 0x9C402402, 0x9C402406, or 0x9C40240A. The devices DeviceEMPNSAUIO and DosDevicesEMPNSAU are similarly affected.

Recommendations: For Epson iProjection version 2.30, consider disabling the virtual audio device driver as a temporary workaround until a patch is available. Restrict access to the driver file EMP NSAU.sys to minimize the risk of exploitation. Avoid using the IOCTL codes 0x9C402402, 0x9C402406, or 0x9C40240A in the affected driver until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2020-9014

Affected Products

Epson Iprojection

References · 9

• 🔥❌ https://github.com/FULLSHADE/Kernel-exploits · Exploit, Deleted
• 🔥❌ https://github.com/FULLSHADE/Kernel-exploits/tree/master/EMP_NSAU.sys · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2020-9014 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9014 · Security Note
• https://epson.com/Support/wa00935 · Vendor Advisory
• https://t.me/cvenotify/31335 · Telegram Post
• https://t.me/cibsecurity/23183 · Telegram Post
• https://epson.com/wireless-projector-app · Note
• https://t.me/cvenotify/9770 · Telegram Post