Epson Printers Scanners CVE-2026-73542

Exploitation requires that the attacker achieve a man-in-the-middle network position between the affected Epson device and its remote communication endpoint - for example, through ARP poisoning, DNS spoofing, or rogue access point on a shared network segment (consistent with AC:H in the CVSS vector). The device must be actively transmitting data over a TLS connection that is validated against the revoked root certificate. No authentication or user interaction is required on the target device itself (PR:N, UI:N). Exploitation is limited to environments where the attacker can realistically intercept network traffic; devices on isolated, firewalled, or physically secured network segments are significantly harder to attack. The impact is limited to confidentiality - an attacker cannot modify data in transit or affect availability based on this vulnerability alone.

The CVSS 3.7 (Low) score reflects a realistic ceiling for this vulnerability: network-reachable (AV:N) but requiring high attack complexity (AC:H) - an attacker must successfully interpose themselves on the network path between the affected device and its remote endpoint. There is no integrity or availability impact (I:N, A:N), and confidentiality impact is limited (C:L). No EPSS data was provided in the input, and the vulnerability is not listed in the CISA KEV catalog, nor is any public proof-of-concept known at time of analysis. SSVC signals suggest low exploitation urgency: the attack is not automatable at scale given AC:H, and technical impact is partial confidentiality only. The practical concern is for environments where printers and scanners transmit sensitive documents over networks that are not otherwise protected - for example, organizations relying solely on device-level TLS rather than network segmentation. The absence of KEV listing and the high complexity bar meaningfully reduce priority compared to raw network-reachability might suggest.

An attacker with access to the network path between an affected Epson printer or scanner and a remote service - for example, via ARP spoofing on a local network segment - presents a certificate issued under one of the revoked root certificates still trusted by the device. The device accepts the certificate as valid, and the attacker establishes a TLS session that allows them to read the plaintext of transmitted data, which may include scanned document content, authentication tokens, or device telemetry. No public proof-of-concept exploit code has been identified for this vulnerability.