Sb H50 Firmware
CVE-2026-23767
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect to ESC/POS printer via network
-
ExploitSend unencrypted ESC/POS commands
-
ExecutionModify print jobs or printer settings
-
ImpactExecute arbitrary functionality without authentication
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | ESC/POS printer exposed on network without authentication mechanisms enabled. No special conditions — remote unauthenticated exploitation against default ESC/POS printer configurations lacking command authorization controls. |
| Impact | CVSS 9.8. |
| Exploit ScenarioDerived | Send unauthorized print commands, waste supplies, or print malicious content. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
ESC/POS printer control language lacks authentication/authorization. Any device on the network can send print commands.
Earlier versions of this analysis (1)
No authentication in ESC/POS printer protocol.
RemediationAI
Implement network-level access control.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-306 in Epson ESC/POS protocol.
Know when Sb H50 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
ESC/POS, a printer control language designed by Seiko Epson Corporation, lacks mechanisms for user authentication and command authorization, does not provide controls to restrict sources or destinations of network communication, and transmits commands without encryption or integrity protection.
Executive ViewAI
Sb-H50 devices running affected firmware versions contain a critical authentication bypass vulnerability (CVSS 9.8) that allows unauthenticated attackers to access and manipulate critical functions. This poses an immediate risk to any organization deploying these devices, as attackers can gain unauthorized control without credentials or detection.
Network segmentation: restrict Sb-H50 device access to trusted internal networks only, block external connectivity. Implement strict firewall rules limiting traffic to critical functions. Deploy intrusion detection/prevention systems to monitor for exploitation attempts. Disable non-essential features on affected devices if possible. Implement physical access controls and enhanced monitoring of device activity logs. Establish 24/7 monitoring for anomalous behavior. Contact vendor urgently for firmware patches or end-of-life guidance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GitHub PoC
Exploit-DB