Epson
14 CVEs across 520 Epson products. Browse Epson vulnerabilities, severities, and proof-of-concept exploits.
Epson products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-23767 | Critical | 9.8 | 2026-03-05 | ESC/POS, a printer control language designed by Seiko Epson Corporation, lacks mechanisms for user authentication and command authorization, does not provide c… |
CVE-2025-4960 | High | 7.8 | 2026-02-19 | The com.epson.InstallNavi.helper tool, deployed with the EPSON printer driver installer, contains a local privilege escalation vulnerability due to multiple fl… |
CVE-2020-37064 | High | 7.8 | 2026-02-01 | EPSON EasyMP Network Projection 2.81 contains an unquoted service path vulnerability in the EMP_NSWLSV service that allows local users to potentially execute a… |
CVE-2020-36984 | High | 7.8 | 2026-01-28 | EPSON 1.124 contains an unquoted service path vulnerability in the SENADB service that allows local attackers to execute code with elevated system privileges… |
CVE-2023-38556 | High | 7.5 | 2023-08-02 | Improper input validation vulnerability in SEIKO EPSON printer Web Config allows a remote attacker to turned off the printer. [Note] Web Config is the softwar… |
CVE-2023-27520 | Medium | 6.5 | 2023-04-11 | Cross-site request forgery (CSRF) vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote unauthenticated attacker to hijack the aut… |
CVE-2023-23572 | Medium | 4.8 | 2023-04-11 | Cross-site scripting vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote authenticated attacker with an administrative privilege… |
CVE-2022-36133 | Critical | 9.1 | 2022-11-25 | The WebConfig functionality of Epson TM-C3500 and TM-C7500 devices with firmware version WAM31500 allows authentication bypass. |
CVE-2020-9453 | Medium | 5.5 | 2021-02-05 | In Epson iProjection v2.30, the driver file EMP_MPAU.sys allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact becau… |
CVE-2020-9014 | Medium | 5.5 | 2021-02-05 | In Epson iProjection v2.30, the driver file (EMP_NSAU.sys) allows local users to cause a denial of service (BSOD) via crafted input to the virtual audio device… |
CVE-2020-5681 | High | 7.8 | 2020-12-24 | Untrusted search path vulnerability in self-extracting files created by EpsonNet SetupManager versions 2.2.14 and earlier, and Offirio SynergyWare PrintDirecto… |
CVE-2020-28931 | High | 8.8 | 2020-12-16 | Lack of an anti-CSRF token in the entire administrative interface in EPSON EPS TSE Server 8 (21.0.11) allows an unauthenticated attacker to force an administra… |
CVE-2020-28930 | Medium | 5.4 | 2020-12-16 | A Cross-Site Scripting (XSS) issue in the 'update user' and 'delete user' functionalities in settings/users.php in EPSON EPS TSE Server 8 (21.0.11) allows an a… |
CVE-2020-28929 | Critical | 9.8 | 2020-12-16 | Unrestricted access to the log downloader functionality in EPSON EPS TSE Server 8 (21.0.11) allows an unauthenticated attacker to remotely retrieve administrat… |
CVE-2020-5674 | High | 7.8 | 2020-11-24 | Untrusted search path vulnerability in the installers of multiple SEIKO EPSON products allows an attacker to gain privileges via a Trojan horse DLL in an unspe… |
CVE-2020-12695 | High | 7.5 | 2020-06-08 | The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a differe… |
CVE-2020-6091 | Critical | 9.1 | 2020-05-22 | An exploitable authentication bypass vulnerability exists in the ESPON Web Control functionality of Epson EB-1470Ui MAIN: 98009273ESWWV107 MAIN2: 8X7325WWV303… |
CVE-2018-0689 | High | 8.8 | 2019-01-09 | HTTP header injection vulnerability in SEIKO EPSON printers and scanners (DS-570W firmware versions released prior to 2018 March 13, DS-780N firmware versions… |
CVE-2018-0688 | Medium | 6.1 | 2019-01-09 | Open redirect vulnerability in SEIKO EPSON printers and scanners (DS-570W firmware versions released prior to 2018 March 13, DS-780N firmware versions released… |
CVE-2018-19248 | Critical | 9.1 | 2018-12-24 | The web service on Epson WorkForce WF-2861 10.48 LQ22I3(Recovery-mode), WF-2861 10.51.LQ20I6, and WF-2861 10.52.LQ17IA devices allows remote attackers to uploa… |
CVE-2018-19232 | High | 7.5 | 2018-12-24 | The web service on Epson WorkForce WF-2861 10.48 LQ22I3(Recovery-mode), WF-2861 10.51.LQ20I6, and WF-2861 10.52.LQ17IA devices allows remote attackers to cause… |
CVE-2018-18960 | Medium | 5.9 | 2018-12-24 | An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices. They use SNMP to find certain devices on the network, b… |
CVE-2018-18959 | High | 7.5 | 2018-12-24 | An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices. On the 'Air Print Setting' web page, if the data for 'B… |
CVE-2018-14903 | High | 7.5 | 2018-08-30 | EPSON WF-2750 printers with firmware JP02I2 do not properly validate files before running updates, which allows remote attackers to cause a printer malfunction… |
CVE-2018-14902 | High | 7.5 | 2018-08-30 | The ContentProvider in the EPSON iPrint application 6.6.3 for Android does not properly restrict data access. This allows an attacker's application to read sca… |
CVE-2018-14901 | High | 7.5 | 2018-08-30 | The EPSON iPrint application 6.6.3 for Android contains hard-coded API and Secret keys for the Dropbox, Box, Evernote and OneDrive services. |
CVE-2018-14900 | High | 7.5 | 2018-08-30 | On EPSON WF-2750 printers with firmware JP02I2, there is no filtering of print jobs. Remote attackers can send print jobs directly to the printer via TCP port… |
CVE-2018-14899 | Medium | 6.1 | 2018-08-30 | On the EPSON WF-2750 printer with firmware JP02I2, the Web interface AirPrint Setup page is vulnerable to HTML Injection that can redirect users to malicious s… |
CVE-2018-5550 | Medium | 6.1 | 2018-02-08 | Versions of Epson AirPrint released prior to January 19, 2018 contain a reflective cross-site scripting (XSS) vulnerability, which can allow untrusted users on… |
CVE-2017-12861 | Critical | 9.8 | 2017-10-10 | The Epson "EasyMP" software is designed to remotely stream a users computer to supporting projectors.These devices are authenticated using a unique 4-digit cod… |
CVE-2017-12860 | Critical | 9.8 | 2017-10-10 | The Epson "EasyMP" software is designed to remotely stream a users computer to supporting projectors.These devices are authenticated using a unique 4-digit cod… |
CVE-2017-6443 | Medium | 6.1 | 2017-03-15 | Cross-site scripting (XSS) vulnerability in EPSON TMNet WebConfig 1.00 allows remote attackers to inject arbitrary web script or HTML via the W_AD1 parameter t… |
CVE-2015-6034 | | 2015-10-28 | EPSON Network Utility 4.10 uses weak permissions (Everyone: Full Control) for eEBSVC.exe, which allows local users to gain privileges via a Trojan horse file. | |
CVE-2010-3920 | | 2010-12-08 | The Seiko Epson printer driver installers for LP-S9000 before 4.1.11 and LP-S7100 before 4.1.7, or as downloaded from the vendor between May 2010 and 20101125… |