What is the CVSS score of CVE-2023-23572?

CVE-2023-23572 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.5%.

Lp 9200Ps2 Firmware CVE-2023-23572

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2023-04-11 vultures@jpcert.or.jp

XSS Lp 9200Ps2 Firmware Lp 9200Ps3 Firmware Lp 8200C Firmware Lp 9600 Firmware Lp 9600S Firmware Lp 9300 Firmware Lp 8500C Firmware Lp 8700Ps3 Firmware Lp 9800C Firmware Lp S5500 Firmware Lp 9200B Firmware Lp 9200C Firmware Lp S4500 Firmware Lp S6500 Firmware Lp S7000 Firmware Lp S5000 Firmware Lp S4000 Firmware Lp S6000 Firmware Lp S5300 Firmware Lp S5300R Firmware Lp S300N Firmware Lp S310N Firmware Lp S3000 Firmware Lp S3000R Firmware Lp S3000Z Firmware Lp S3000Ps Firmware Lp S7500 Firmware Lp S7500Ps Firmware Lp S3500 Firmware Lp S4200 Firmware Lp S9000 Firmware Lp S7100 Firmware Lp S8100 Firmware Prifnw1 Firmware Prifnw1S Firmware Prifnw2 Firmware Prifnw2Ac Firmware Prifnw2S Firmware Prifnw2Sac Firmware Prifnw3 Firmware Prifnw3S Firmware Prifnw6 Firmware Prifnw7 Firmware Prifnw7U Firmware Prifnw7S Firmware Pa W11G Firmware Pa W11G2 Firmware Esnsb1 Firmware Esnsb2 Firmware Esifnw1 Firmware

4.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Apr 11, 2023 - 09:15 nvd

MEDIUM 4.8

DescriptionNVD

Cross-site scripting vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script. [Note] Web Config is the software that allows users to check the status and change the settings of SEIKO EPSON printers/network interface via a web browser. According to SEIKO EPSON CORPORATION, it is also called as Remote Manager in some products. Web Config is pre-installed in some printers/network interface provided by SEIKO EPSON CORPORATION. For the details of the affected product names/model numbers, refer to the information provided by the vendor.

AnalysisAI

Cross-site scripting vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. Cross-site scripting vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script. [Note] Web Config is the software that allows users to check the status and change the settings of SEIKO EPSON printers/network interface via a web browser. According to SEIKO EPSON CORPORATION, it is also called as Remote Manager in some products. Web Config is pre-installed in some printers/network interface provided by SEIKO EPSON CORPORATION. For the details of the affected product names/model numbers, refer to the information provided by the vendor. Affected products include: Epson Lp-9200Ps2 Firmware, Epson Lp-9200Ps3 Firmware, Epson Lp-8200C Firmware, Epson Lp-9600 Firmware, Epson Lp-9600S Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.