Vulnerability in ESC/POS command for POS printers - Frequently Asked Questions

A vulnerability has been identified in Epson Web Config (*1) that allows users to check device status and change settings via a web browser on certain printer and scanner products.
(*1) Epson Web Config is a feature that allows users to check the device status and change settings by entering the device's IP address into the URL field of a web browser such as Edge or Safari.

This is a Cross-Site Request Forgery (CSRF) vulnerability.
If a user accesses a malicious website created by a third party, there is a possibility that the settings of the affected device may be altered via the Web Config interface.

At present, no incidents of this vulnerability being exploited have been confirmed.

To ensure safe and secure use of your product, please refer to the Security Guidebook at the following URL: Security for printers and MFPs

<Installation and configuration based on the Security Guidebook (Chapter 3)>

1. Do not connect the product directly to the Internet, and instead install it within a network protected by a firewall. When doing so, use a private IP address.

<Operational precautions related to this issue>

2. Always log out after logging in as an administrator.
　Do not remain logged into Web Config as an administrator for extended periods. Be sure to log out after completing your work.
While logged in as an administrator, do not browse suspicious websites, click untrusted links, pen unknown files or similar actions.

For more information on the Security Guidebook, please refer to:
Precautions When Connecting Epson Products to a Network