CVE-2023-27520

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Cross-site request forgery (CSRF) vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote unauthenticated attacker to hijack the authentication and perform unintended operations by having a logged-in user view a malicious page. [Note] Web Config is the software that allows users to check the status and change the settings of SEIKO EPSON printers/network interface via a web browser. According to SEIKO EPSON CORPORATION, it is also called as Remote Manager in some products. Web Config is pre-installed in some printers/network interface provided by SEIKO EPSON CORPORATION. For the details of the affected product names/model numbers, refer to the information provided by the vendor.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Apr 11, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-275218.8OS command injection vulnerability in the mail setting page of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F v CVE-2023-275227.5HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through CVE-2023-275234.3Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user t CVE-2023-275249.8Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured CVE-2023-275254.3An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset u CVE-2023-275264.3A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.CVE-2023-275277.5Shinseiyo Sogo Soft (7.9A) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file CVE-2023-275297.8Wacom Tablet Driver installer prior to 6.4.2-1 (for macOS) contains an improper link resolution before file access vulnerability. When a use CVE-2023-27535.4Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.CVE-2023-275307.5A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could al CVE-2023-275315.3There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization code CVE-2023-275327.5Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This