EUVD-2026-63198
GHSA-mw8v-5vg6-vwx7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
MitM requires high-complexity network positioning (AC:H); no privileges or interaction needed; impact is limited to partial confidentiality of transmitted data.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Multiple SEIKO EPSON printers and scanners contain revoked root certificates. A man-in-the-middle attack may allow an attacker to obtain communication data transmitted by the product. As for the details of the affected products and versions, refer to the vendor's information.
AnalysisAI
Revoked root certificates embedded in multiple Seiko Epson printers and scanners expose device communications to interception via man-in-the-middle attacks. Affected products continue to trust certificates that have been revoked, violating the chain-of-trust model defined by CWE-296, and allowing a suitably positioned attacker to decrypt or read transmitted data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker achieve a man-in-the-middle network position between the affected Epson device and its remote communication endpoint - for example, through ARP poisoning, DNS spoofing, or rogue access point on a shared network segment (consistent with AC:H in the CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.7 (Low) score reflects a realistic ceiling for this vulnerability: network-reachable (AV:N) but requiring high attack complexity (AC:H) - an attacker must successfully interpose themselves on the network path between the affected device and its remote endpoint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with access to the network path between an affected Epson printer or scanner and a remote service - for example, via ARP spoofing on a local network segment - presents a certificate issued under one of the revoked root certificates still trusted by the device. The device accepts the certificate as valid, and the attacker establishes a TLS session that allows them to read the plaintext of transmitted data, which may include scanned document content, authentication tokens, or device telemetry. … |
| Remediation | The primary remediation path is to apply firmware updates provided by Seiko Epson that replace or distrust the revoked root certificates; consult the vendor advisory at https://www.epson.jp/news/info/a-security202608.htm for model-specific firmware versions and update instructions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today