CVE-2026-23767ESC/POS, a printer control language designed by Seiko Epson Corporation, lacks mechanisms for user authentication and command authorization, does not provide controls to restrict sources or destinati…
Updated under an hour ago ()
Does this affect you?
It affects epson sb-h50_firmware and 23 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
ESC/POS, a printer control language designed by Seiko Epson Corporation, lacks mechanisms for user authentication and command authorization, does not provide controls to restrict sources or destinations of network communication, and transmits commands without encryption or integrity protection.
- CVSS
- 9.8 CRITICAL (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-306
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Analyzed
- Record last updated
- Jun 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
epson sb-h50_firmware epson:sb-h50_firmware | all versions | NVD |
epson tm-h6000v_firmware epson:tm-h6000v_firmware | all versions | NVD |
epson tm-l100_firmware epson:tm-l100_firmware | all versions | NVD |
epson tm-m10_firmware epson:tm-m10_firmware | all versions | NVD |
epson tm-m30_firmware epson:tm-m30_firmware | all versions | NVD |
epson tm-m30ii_firmware epson:tm-m30ii_firmware | all versions | NVD |
epson tm-m30ii-h_firmware epson:tm-m30ii-h_firmware | all versions | NVD |
epson tm-m30ii-s_firmware epson:tm-m30ii-s_firmware | all versions | NVD |
epson tm-m30ii-sl_firmware epson:tm-m30ii-sl_firmware | all versions | NVD |
epson tm-m30iii_firmware epson:tm-m30iii_firmware | all versions | NVD |
epson tm-m30iii-h_firmware epson:tm-m30iii-h_firmware | all versions | NVD |
epson tm-m55_firmware epson:tm-m55_firmware | all versions | NVD |
epson tm-p20ii_firmware epson:tm-p20ii_firmware | all versions | NVD |
epson tm-p80ii_firmware epson:tm-p80ii_firmware | all versions | NVD |
epson tm-p20_firmware epson:tm-p20_firmware | all versions | NVD |
epson tm-p60ii_firmware epson:tm-p60ii_firmware | all versions | NVD |
epson tm-p80_firmware epson:tm-p80_firmware | all versions | NVD |
epson tm-t20ii_firmware epson:tm-t20ii_firmware | all versions | NVD |
epson tm-t20iii_firmware epson:tm-t20iii_firmware | all versions | NVD |
epson tm-t88vi_firmware epson:tm-t88vi_firmware | all versions | NVD |
epson tm-t88vi-ihub_firmware epson:tm-t88vi-ihub_firmware | all versions | NVD |
epson tm-t88vii_firmware epson:tm-t88vii_firmware | all versions | NVD |
epson ub-r04_firmware epson:ub-r04_firmware | all versions | NVD |
epson ub-e04_firmware epson:ub-e04_firmware | all versions | NVD |
References
- https://download4.epson.biz/sec_pubs/bs/pdf/IP_Filtering_Guide_en_revA.pdfproduct
- https://jvn.jp/en/ta/JVNTA97995322/third-party-advisory
- https://www.epson.jp/support/misc_t/260305_oshirase.htmvendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.