PT-2021-12854 · Epson · Epson Iprojection

Published 2021-02-05 · Updated 2023-02-17 · CVE-2020-9453

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Epson iProjection version 2.30

Description: The driver file EMP MPAU.sys in Epson iProjection allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C402406 and IOCtl 0x9C40240A. This affects DeviceEMPMPAUIO and DosDevicesEMPMPAU.

Recommendations: For Epson iProjection version 2.30, consider disabling the EMP MPAU.sys driver file as a temporary workaround until a patch is available. Restrict access to the affected devices DeviceEMPMPAUIO and DosDevicesEMPMPAU to minimize the risk of exploitation. Avoid using the IOCtl codes 0x9C402406 and 0x9C40240A in the affected driver file until the issue is resolved.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2020-9453

Affected Products

Epson Iprojection

References · 10

• 🔥❌ https://github.com/FULLSHADE/Kernel-exploits · Exploit, Deleted
• 🔥❌ https://github.com/FULLSHADE/Kernel-exploits/tree/master/EMP_MPAU.sys · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2020-9453 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9453 · Security Note
• https://epson.com/Support/wa00936 · Vendor Advisory
• https://t.me/cvenotify/44542 · Telegram Post
• https://epson.com · Note
• https://t.me/cvenotify/9774 · Telegram Post
• https://t.me/cibsecurity/23175 · Telegram Post
• https://t.me/cvenotify/31334 · Telegram Post