Vulnerability in EPSON WebConfig / Epson Web Control for Projector Products

Vulnerability Reference: CVE-2025-64310

Description:

A vulnerability has been identified in some Epson projector products when using the software (EPSON WebConfig / Epson Web Control) that allows you to check the status of the product itself or change settings via a Web browser.

The password authentication (Web Control Password and Remote Password) of the affected product does not have a restriction or lockout mechanism, so an attacker can try an unlimited number of passwords, making the projector vulnerable to brute-force attacks. If the Web Control Password or Remote Password are discovered through a brute-force attack, a third party may be able to take control of the projector and:

• Operate the turning on-off of the projector, input source change etc.
• Edit content stored on a USB flash drive or SD card. (Content Playback mode compatible models)
• Capture projected images using Remote Camera Access. (Remote Camera Access compatible models)
• Refer to projector’s log file saved on a USB flash drive. (Log Save compatible models)

Impact:

Currently, there are no reports of any attacks exploiting this vulnerability.

Solution:

• Products other than those listed below are not affected.
• For affected products that are currently available for sale (and for some that have reached end of life (meaning are not produced anymore)), we are rolling out the release of countermeasure firmware. We strongly recommend that you download this firmware from the Epson website and apply the update as soon as it is available.
• For other products (and for products awaiting the firmware release), we strongly recommend that you take additional security measures (see description below).

Additional security measures:

• Installation and configuration according to the user’s guide
  The product should not be directly connected to the Internet and should be installed in a network protected by a firewall. Please set a private IP address and operate.
• Set a Web Control Password and Remote Password for each product.
  The Web Control Password and Remote Password should be a complex string that is difficult for others to guess, mixing characters, symbols and numbers and ensuring it is at least 8 characters long.
• Stronger precautions – Block HTTP (TCP/80 port and TCP/433 port) access to the product*
  After configuring the product, block HTTP access (TCP/80 port and TCP/433 port) to the product with a network device (router or switch). Open the port only when you need to update the application settings or firmware.
  * Due to this restriction, the functions in EPSON WebConfig and Epson Web Control may not be available.

Affected Products