EPSON Web Config CVE-2026-58315

Q: What is the CVSS score of CVE-2026-58315?

CVE-2026-58315 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-42007 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-07 vultures@jpcert.or.jp

GHSA-2m7v-q2j4-mr6f

CSRF

5.1

CVSS 4.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-delivered CSRF requiring victim interaction (UI:R); no privileges for attacker (PR:N); only limited integrity impact with no scope change or confidentiality/availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 06:39 vuln.today

DescriptionCVE.org

Cross-site request forgery vulnerability exists in SEIKO EPSON Web Config. If a user views a malicious page while logged into Web Config, unintended operations may be performed.

AnalysisAI

Cross-site request forgery in SEIKO EPSON Web Config allows a remote, unauthenticated attacker to trigger unintended configuration changes on Epson network devices by luring an authenticated administrator into visiting a malicious web page. The vulnerability (CWE-352) requires no privileges on the attacker's side but depends on an active, authenticated Web Config session on the victim's browser. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

SEIKO EPSON Web Config is the embedded web-based administration interface shipped with Epson network printers and multifunction devices, typically accessible over HTTP/HTTPS on the local network. CWE-352 (Cross-Site Request Forgery) arises when a web application fails to distinguish between legitimate same-origin requests and forged cross-origin requests submitted by the victim's authenticated browser. In this case, Web Config does not appear to implement sufficient anti-CSRF tokens, origin validation, or SameSite cookie policies to block forged state-changing requests. An attacker can exploit this by hosting a web page containing hidden requests targeting the Web Config endpoint; when a logged-in administrator visits the page, the browser automatically includes session credentials, causing the device to process the forged request as legitimate. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L) confirms network delivery, low complexity, no attack prerequisites, and limited integrity impact on the vulnerable system only.

RemediationAI

Consult the Epson security notice at https://www.epson.jp/news/info/a-security202607.htm and the JVN advisory at https://jvn.jp/en/jp/JVN87285119/ to identify patched firmware versions for your specific Epson device model and apply the vendor-released update. No exact fix version was included in the available data, so administrators should check those references directly. As a compensating control where firmware updates cannot be applied immediately, restrict access to the Web Config interface to trusted management VLANs or hosts using firewall rules or network ACLs, reducing the window in which a CSRF attack can reach the device. Additionally, administrators should avoid browsing untrusted websites from the same browser session used to manage Web Config. Enforcing logout from Web Config after management tasks eliminates the session precondition required for exploitation.