PT-2024-10736 · Epson · Epson Expression Home Xp255

Jasper Nota + 2 · Published 2024-11-07 · Updated 2024-11-10 · CVE-2019-20460

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Epson Expression Home XP255 version 20.08.FM10I8

Description An issue was discovered where POST requests do not require anti-CSRF tokens or other mechanisms for validating that the request is from a legitimate source. This allows for CSRF attacks to be used to send text directly to the RAW printer interface, potentially delivering unwanted printouts to end users.

Recommendations For Epson Expression Home XP255 version 20.08.FM10I8, consider disabling the ability to send POST requests to the printer interface until a patch is available. Restrict access to the printer's RAW interface to minimize the risk of exploitation. Update to the latest firmware as soon as it becomes available to mitigate this issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-20460

Affected Products

Epson Expression Home Xp255

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2019-20460 · Security Note
• https://twitter.com/transilienceai/status/1855476567721283795 · Twitter Post
• https://twitter.com/CVEnew/status/1854624472491241639 · Twitter Post
• https://epson.com/Support/wa00826 · Note
• https://seclists.org/fulldisclosure/2024/Jul/14 · Note
• http://seclists.org/fulldisclosure/2024/Jul/14 · Note
• https://t.me/cvedetector/10131 · Telegram Post
• https://twitter.com/transilienceai/status/1855476583516999845 · Twitter Post
• https://twitter.com/transilienceai/status/1855476754913104331 · Twitter Post
• https://twitter.com/transilienceai/status/1855476666463572303 · Twitter Post
• https://twitter.com/transilienceai/status/1855476572884480147 · Twitter Post
• https://twitter.com/transilienceai/status/1855476562730115486 · Twitter Post
• https://twitter.com/transilienceai/status/1855476589498093582 · Twitter Post