CVE-2020-9014

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In Epson iProjection v2.30, the driver file (EMP_NSAU.sys) allows local users to cause a denial of service (BSOD) via crafted input to the virtual audio device driver with IOCTL 0x9C402402, 0x9C402406, or 0x9C40240A. \Device\EMPNSAUIO and \DosDevices\EMPNSAU are similarly affected.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://epson.com/Support/wa00935Patch, Vendor Advisory
https://epson.com/wireless-projector-appProduct
https://github.com/FULLSHADE/Kernel-exploitsPatch, Third Party Advisory
https://github.com/FULLSHADE/Kernel-exploits/tree/master/EMP_NSAU.sysPatch, Third Party Advisory
https://epson.com/Support/wa00935Patch, Vendor Advisory
https://epson.com/wireless-projector-appProduct
https://github.com/FULLSHADE/Kernel-exploitsPatch, Third Party Advisory
https://github.com/FULLSHADE/Kernel-exploits/tree/master/EMP_NSAU.sysPatch, Third Party Advisory

Timeline

Published: Feb 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-90159.8Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices (and possibly other products) allow a CVE-2020-90165.4Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header.CVE-2020-90178.0LiteCart through 2.2.1 allows CSV injection via a customer's profile.CVE-2020-90185.3LiteCart through 2.2.1 allows admin/?app=users&doc=edit_user CSRF to add a user.CVE-2020-90196.1The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description.CVE-2020-90209.8Iteris Vantage Velocity Field Unit 2.3.1, 2.4.2, and 3.0 devices allow the injection of OS commands into cgi-bin/timeconfig.py via shell met CVE-2020-90219.8Post Oak AWAM Bluetooth Field Device 7400v2.08.21.2018, 7800SD.2015.1.16, 2011.3, 7400v2.02.01.2019, and 7800SD.2012.12.5 is vulnerable to i CVE-2020-90226.1An issue was discovered on Xirrus XR520, XR620, XR2436, and XH2-120 devices. The cgi-bin/ViewPage.cgi user parameter allows XSS.CVE-2020-90239.8Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have two users that are not documented and are configured with weak passwords (Us CVE-2020-90249.8Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have world-writable permissions for the /root/cleardata.pl (executed as root by c CVE-2020-90256.1Iteris Vantage Velocity Field Unit 2.4.2 devices have multiple stored XSS issues in all parameters of the Start Data Viewer feature of the /CVE-2020-90269.8ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the PING field of the resource ping.cmd. The NTP-2 device is also a