CVE-2024-47295: EPSON Web Config Auth Bypass Vulnerability

CVE-2024-47295 Overview

CVE-2024-47295 is an insecure initial password configuration flaw in SEIKO EPSON Web Config. The vulnerability affects devices shipped without a preconfigured administrator password. A remote unauthenticated attacker can reach the Web Config interface and set an arbitrary administrator password before the legitimate owner does. After setting the password, the attacker gains full administrative control over the device. The flaw is categorized under [CWE-1188]: Insecure Default Initialization of Resource. Affected versions are listed in the vendor advisory. EPSON has published support documentation describing the issue and remediation steps for printers, scanners, and other networked devices that ship with Web Config.

Critical Impact

A remote unauthenticated attacker can claim administrative ownership of an unprovisioned EPSON device by setting the initial password through Web Config, leading to full device compromise.

Affected Products

• SEIKO EPSON printers, scanners, and multifunction devices using Web Config
• Devices in default factory state with no administrator password configured
• See the Epson Support Information for the complete list of affected models and firmware versions

Discovery Timeline

• 2024-10-01 - CVE-2024-47295 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-47295

Vulnerability Analysis

Web Config is the embedded HTTP/HTTPS administration interface on EPSON network-connected devices. It exposes settings for network configuration, printing services, scanning, and security. The vulnerability stems from the device shipping without an administrator password set on first boot. Any party that reaches the Web Config endpoint before the owner can submit the initial password form and become the administrator. The legitimate owner is then locked out of administrative functions because authentication now requires the attacker-controlled credentials. An attacker with administrative privileges can modify device configuration, intercept print and scan jobs, exfiltrate stored documents, alter firmware update settings, and pivot to other systems on the network.

Root Cause

The root cause is an insecure default initialization pattern tracked as [CWE-1188]. The device ships with the administrator account in an uninitialized state and accepts password assignment from the first network client that requests it. No out-of-band verification, physical proof of possession, or local-only setup mode gates the initial password assignment.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker scans for EPSON Web Config interfaces reachable over the local network or, where devices are inadvertently exposed, over the internet. The attacker submits an HTTP request to the initial password configuration endpoint, supplies arbitrary credentials, and gains administrative access. The high attack complexity reflects the timing window — the attacker must reach the device before the legitimate owner provisions it. Devices placed into service without prompt password configuration remain exposed for the duration of that window.

No verified public proof-of-concept code is available. See the JVN Vulnerability Report for technical advisory details.

Detection Methods for CVE-2024-47295

Indicators of Compromise

• Web Config administrator password change events on devices that the operations team did not provision
• Unexpected modifications to printer or scanner network settings, SMTP relays, or LDAP integration
• Print or scan jobs routed to unknown destinations, file shares, or cloud services
• Firmware update settings altered to point at unofficial servers

Detection Strategies

• Inventory all EPSON devices on the network and verify each has a known administrator password set by the operations team
• Query Web Config on each device and confirm the administrator account is initialized; uninitialized devices are exposed
• Monitor HTTP/HTTPS traffic to EPSON Web Config endpoints for POST requests to password initialization paths from unexpected source addresses
• Correlate device configuration changes with authorized change management tickets

Monitoring Recommendations

• Forward Web Config access logs and syslog events from EPSON devices to a central log platform for review
• Alert on first-time administrator password set events outside provisioning windows
• Track network flows to and from printers and scanners; flag outbound connections to unknown destinations
• Review device configuration baselines weekly and investigate drift

How to Mitigate CVE-2024-47295

Immediate Actions Required

• Set an administrator password on every EPSON Web Config interface immediately upon device deployment, before connecting the device to a production network
• Audit existing devices and reset any that show an uninitialized or unknown administrator account state by following the procedure in the Epson Advisory Update
• Apply firmware updates listed in the vendor advisory once available for the specific model
• Restrict Web Config access to management VLANs and block exposure to untrusted networks and the public internet

Patch Information

EPSON has published guidance and firmware updates for affected models. Refer to the Epson Support Information page for model-specific firmware versions and the recommended initialization procedure. Apply updates through the official EPSON firmware distribution channel.

Workarounds

• Place new EPSON devices on an isolated provisioning network and set the administrator password before moving them to production
• Disable Web Config on devices that do not require remote administration, where the device supports this option
• Enforce network access control lists that restrict TCP/80 and TCP/443 access to EPSON devices to authorized management hosts
• Use network segmentation to ensure printers and scanners cannot be reached from guest, IoT, or untrusted client subnets

# Example: restrict Web Config access using an ACL on the management switch
# Permit only the administrator workstation subnet to reach the printer
access-list 110 permit tcp 10.10.50.0 0.0.0.255 host 10.20.30.40 eq 80
access-list 110 permit tcp 10.10.50.0 0.0.0.255 host 10.20.30.40 eq 443
access-list 110 deny   tcp any host 10.20.30.40 eq 80
access-list 110 deny   tcp any host 10.20.30.40 eq 443