CVE-2021-43718: EPSON EH-TW5350 Auth Bypass Vulnerability

CVE-2021-43718 Overview

CVE-2021-43718 is an Authentication Bypass vulnerability [CWE-288] affecting the EPSON EH-TW5350 projector running firmware EPSON 150075647YWWV110. A remote unauthenticated attacker can send a specially crafted series of HTTP requests to the device's web management interface to trigger a Denial of Service condition. The flaw is exploitable over the network without user interaction and without prior credentials, but its impact is limited to availability.

Critical Impact
Remote attackers can bypass authentication controls on the EH-TW5350 web interface and force the projector into a Denial of Service state via crafted HTTP traffic.

Affected Products

EPSON EH-TW5350 Projector
Firmware version EPSON 150075647YWWV110
Web management HTTP interface on the affected device

Discovery Timeline

2026-08-18 - CVE-2021-43718 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2021-43718

Vulnerability Analysis

The EPSON EH-TW5350 exposes a web management interface intended for local administrative access. The interface fails to properly enforce authentication on certain HTTP request sequences, allowing an unauthenticated remote client to reach protected functionality. According to the published advisory, sending a specially crafted series of HTTP requests places the device into an unresponsive state, requiring manual intervention to restore service.

The issue is categorized under CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The projector's HTTP handling logic does not validate session state consistently across all request paths, which permits attackers to reach handlers that should require prior authentication. EPSS data reports a probability of 0.243% at the 15.762 percentile as of 2026-08-20.

Root Cause

The root cause is missing or incomplete authentication enforcement on the projector's embedded HTTP server. Request handlers that should require an authenticated session accept input from unauthenticated clients, and malformed request sequences drive the device into a Denial of Service state. Full technical details are documented in the GitHub Advisory CVE-2021-43718.

Attack Vector

An attacker with network reachability to the projector's HTTP interface sends a crafted sequence of requests that bypass authentication checks. No credentials, user interaction, or elevated privileges are required. Successful exploitation causes the device to stop responding, disrupting presentations, digital signage, or other use cases relying on the projector.

No verified public exploit code is available. See the GitHub Advisory CVE-2021-43718 for reproduction details published by the reporter.

Detection Methods for CVE-2021-43718

Indicators of Compromise

Repeated HTTP requests to the EH-TW5350 management interface from unexpected source addresses
Projector becoming unresponsive or requiring power-cycling after HTTP traffic bursts
Anomalous request patterns targeting authentication endpoints on TCP ports used by the embedded web server

Detection Strategies

Monitor network flows to and from EPSON projectors and alert on HTTP sessions originating outside the administrative VLAN
Correlate device availability drops with preceding inbound HTTP activity to identify DoS attempts
Inspect HTTP traffic for malformed or repeated request sequences aligned with the patterns described in the public advisory

Monitoring Recommendations

Log all inbound HTTP requests to projector management interfaces at the network perimeter or segmentation firewall
Track device uptime and reachability using SNMP or ICMP polling to catch DoS conditions early
Alert on any new external host initiating connections to IoT/AV device subnets

How to Mitigate CVE-2021-43718

Immediate Actions Required

Restrict access to the EH-TW5350 web management interface to a dedicated management VLAN
Block inbound HTTP requests to the projector from untrusted networks at the firewall
Disable the web management interface when not actively required for configuration

Patch Information

No vendor patch is referenced in the enriched CVE data. Consult EPSON support channels and the GitHub Advisory CVE-2021-43718 for the latest firmware guidance for the EH-TW5350 platform.

Workarounds

Place affected projectors behind network segmentation that only permits traffic from authorized administrator workstations
Apply access control lists on switches or firewalls to limit HTTP access to the projector to specific source IPs
Physically disconnect the projector from the network when remote management is not required

bash

# Example iptables rule limiting HTTP access to the projector to a single admin host
iptables -A FORWARD -p tcp -d <projector_ip> --dport 80 -s <admin_ip> -j ACCEPT
iptables -A FORWARD -p tcp -d <projector_ip> --dport 80 -j DROP