What is the CVSS score of CVE-2026-23767?

CVE-2026-23767 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tm M30iii H Firmware are affected by CVE-2026-23767?

Sb-H50 devices running affected firmware versions contain a critical authentication bypass vulnerability (CVSS 9.8) that allows unauthenticated attackers to access and manipulate critical functions.

How to fix or mitigate CVE-2026-23767?

Within 24 hours: Inventory all Sb-H50 devices in production and identify firmware versions; immediately isolate affected devices to restricted network segments and disable external access. Within 7 days: Contact vendor for emergency patches, firmware updates, or hotfixes; conduct security audit of affected device access logs for signs of exploitation. Within 30 days: Deploy patched firmware to all affected devices; implement network access controls and monitoring to prevent unauthorized device access; document remediation completion and risk acceptance for any devices unable to be patched.

Tm M30iii H Firmware CVE-2026-23767

CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-03-05 vultures@jpcert.or.jp

Authentication Bypass Tm M30iii H Firmware Tm T88vi Ihub Firmware Tm T88vii Firmware Tm L100 Firmware Tm T20ii Firmware Tm P20ii Firmware Tm H6000v Firmware Tm M10 Firmware Tm P60ii Firmware Ub R04 Firmware Tm M30ii S Firmware Ub E04 Firmware Tm M55 Firmware Tm T20iii Firmware Sb H50 Firmware Tm P20 Firmware Tm T88vi Firmware Tm P80 Firmware Tm P80ii Firmware Tm M30ii Sl Firmware Tm M30ii Firmware Tm M30ii H Firmware Tm M30iii Firmware Tm M30 Firmware

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

CRITICAL 9.8

DescriptionCVE.org

ESC/POS, a printer control language designed by Seiko Epson Corporation, lacks mechanisms for user authentication and command authorization, does not provide controls to restrict sources or destinations of network communication, and transmits commands without encryption or integrity protection.