{"id":"CVE-2024-47295","state":"PUBLISHED","title":"Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary password and operate the device with an adminis","description":"Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary password and operate the device with an administrative privilege. As for the details of the affected versions, see the information provided by the vendor under [References].","publishedAt":"2024-10-01T03:16:40.052Z","updatedAt":"2024-11-11T07:15:21.646Z","severity":{"score":8.1,"label":"High","version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"jpcert"},"assigner":"jpcert","products":["SEIKO EPSON CORPORATION Web Config"],"affected":[{"vendor":"SEIKO EPSON CORPORATION","product":"Web Config","versions":[{"version":"See the information/details provided by the vendor","status":"affected"}]}],"references":["https://epson.com/Support/wa00958","https://www.epson.jp/support/misc_t/240930_03_oshirase.htm","https://jvn.jp/en/vu/JVNVU95133448/"],"weaknesses":["CWE-1188"],"ingestedAt":"2026-10-29T20:07:56.516Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/47xxx/CVE-2024-47295.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-47295","state":"PUBLISHED","datePublished":"2024-10-01T03:16:40.052Z","dateUpdated":"2024-11-11T07:15:21.646Z","assignerShortName":"jpcert","assignerOrgId":"ede6fdc4-6654-4307-a26d-3331c018e2ce","dateReserved":"2024-09-24T08:32:15.357Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary password and operate the device with an administrative privilege. As for the details of the affected versions, see the information provided by the vendor under [References]."}],"affected":[{"vendor":"SEIKO EPSON CORPORATION","product":"Web Config","versions":[{"version":"See the information/details provided by the vendor","status":"affected"}]}],"references":[{"url":"https://epson.com/Support/wa00958"},{"url":"https://www.epson.jp/support/misc_t/240930_03_oshirase.htm"},{"url":"https://jvn.jp/en/vu/JVNVU95133448/"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_0":{"version":"3.0","baseSeverity":"HIGH","baseScore":8.1,"vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1188","description":"Initialization of a resource with an insecure default","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"shortName":"jpcert","orgId":"ede6fdc4-6654-4307-a26d-3331c018e2ce","dateUpdated":"2024-11-11T07:15:21.646Z"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"seiko_epson_corporation","product":"web_config","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"*","versionType":"custom"}],"cpes":["cpe:2.3:a:seiko_epson_corporation:web_config:*:*:*:*:*:*:*:*"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-10-01T14:01:15.326202Z","id":"CVE-2024-47295","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-01T14:01:18.787Z"}}]}}}