CVE-2026-73542: EPSON Printers Information Disclosure Flaw

CVE-2026-73542 Overview

CVE-2026-73542 affects multiple SEIKO EPSON printers and scanners that ship with revoked root certificates in their trust stores. Because the devices continue to trust certificate authorities that have been formally revoked, an attacker positioned on the network path can present a certificate signed by a revoked CA and complete a Transport Layer Security (TLS) handshake with the device. This enables a man-in-the-middle (MITM) attacker to intercept and read communication data transmitted by the affected product. The weakness is tracked under CWE-296: Improper Following of a Certificate's Chain of Trust.

Critical Impact
An adjacent or network-positioned attacker can intercept confidential print jobs, scanned documents, and administrative traffic exchanged with affected Epson devices.

Affected Products

Multiple SEIKO EPSON printers (refer to vendor advisory for model list)
Multiple SEIKO EPSON scanners (refer to vendor advisory for model list)
See the Epson Security Information Announcement for exact affected firmware versions

Discovery Timeline

2026-08-20 - CVE-2026-73542 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73542

Vulnerability Analysis

The affected Epson printers and scanners maintain an internal trust store of root Certificate Authorities (CAs) used to validate outbound and inbound TLS connections. One or more of the root certificates stored in these devices have been revoked by their issuing authorities. The devices, however, continue to accept certificate chains that terminate at these revoked roots. This is an improper certificate validation issue rather than a cryptographic flaw in TLS itself.

Because the device does not honor revocation status for its trust anchors, any endpoint holding a leaf certificate that chains to a revoked root can impersonate a trusted server. The attacker uses this impersonation to relay traffic between the printer or scanner and its legitimate destination. Confidentiality of transmitted data is impacted; integrity and availability are not directly affected by this specific weakness.

Root Cause

The root cause is the presence of revoked CA certificates in the device firmware trust store, combined with the absence of an effective revocation-checking mechanism such as Online Certificate Status Protocol (OCSP) or Certificate Revocation List (CRL) validation against trust anchors. Embedded firmware often ships with a static list of root certificates and lacks a mechanism to update or invalidate them post-deployment.

Attack Vector

The attack requires network adjacency or a position that allows the attacker to intercept traffic between the Epson device and its intended TLS peer, for example a cloud print service, firmware update endpoint, or scan-to-cloud destination. The attacker presents a TLS server certificate chained to one of the revoked roots still trusted by the device. The device completes the handshake, and the attacker proxies traffic while capturing plaintext content. No user interaction on the device is required, but the attacker must have a valid leaf certificate signed under the revoked chain.

No verified public exploit code is available for this vulnerability. See the JVN Security Vulnerability Report for additional technical background.

Detection Methods for CVE-2026-73542

Indicators of Compromise

TLS sessions from Epson devices terminating at unexpected IP addresses or hostnames not associated with Epson infrastructure or the organization's print servers.
Server certificates presented to Epson devices that chain to CAs listed on public revocation feeds.
Unusual outbound connections from printers or scanners to hosts on non-standard ports used for print or scan-to-cloud services.

Detection Strategies

Inspect TLS handshakes originating from printer and scanner VLANs using a network TLS inspection tool, and flag any chain that includes a revoked root.
Correlate device firmware versions against the Epson Security Information Announcement to identify unpatched assets.
Monitor DNS resolutions from print device subnets for domains that do not match approved Epson cloud endpoints.

Monitoring Recommendations

Log and retain full TLS metadata (Server Name Indication, issuer, serial number) for all connections initiated by multifunction devices.
Alert on any newly observed CA issuer appearing in printer or scanner TLS traffic.
Baseline normal traffic volume between printers and cloud services; investigate deviations that could indicate proxying by a MITM attacker.

How to Mitigate CVE-2026-73542

Immediate Actions Required

Apply firmware updates from Epson as listed in the vendor advisory once available for your specific model.
Isolate affected printers and scanners on a dedicated VLAN with strict egress filtering to only approved Epson service endpoints.
Disable cloud print, scan-to-cloud, and remote management features on affected devices until firmware is updated.
Enforce mutual TLS or IPsec between print servers and devices where the platform supports it.

Patch Information

SEIKO EPSON has published affected product and firmware version details in the Epson Security Information Announcement. Administrators should identify each affected model in their fleet and apply the firmware version indicated by the vendor. The JVN Security Vulnerability Report provides a consolidated summary and points to Epson's remediation guidance.

Workarounds

Place affected devices behind a TLS-terminating proxy that performs strict certificate validation, including revocation checking, on behalf of the device.
Block outbound Internet access from the printer and scanner network segment except to allow-listed vendor endpoints.
Require print and scan traffic to traverse an internal print server that authenticates users and encrypts jobs independently of the device TLS stack.

bash

# Example egress restriction for a printer VLAN (illustrative)
# Allow only Epson service endpoints; drop all other outbound traffic
iptables -A FORWARD -s 10.20.30.0/24 -d epson-service.example.net -j ACCEPT
iptables -A FORWARD -s 10.20.30.0/24 -j DROP