Description

Multiple SEIKO EPSON printers and scanners contain revoked root certificates. A man-in-the-middle attack may allow an attacker to obtain communication data transmitted by the product. As for the details of the affected products and versions, refer to the vendor's information.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-20T06:17:13.287Z",
  "pubdate": "2026-08-20T06:17:13.287Z",
  "executiveSummary": "Multiple SEIKO EPSON printers and scanners contain revoked root certificates within their trust stores, leading to a cryptographic trust validation vulnerability.\nThe primary impact of this security flaw is the potential compromise of confidentiality through man-in-the-middle (MitM) interception, allowing an adversary to capture sensitive communication data transmitted to and from the affected hardware.\nThe affected systems comprise various SEIKO EPSON printer and scanner models as specified by vendor advisories.\nThe risk implications are significant for enterprise and consumer environments where devices handle sensitive print jobs, network credentials, and administrative traffic over secure channels.\nAn attacker must be positioned in a network vantage point capable of intercepting traffic between the target product and external endpoints to execute the MitM attack successfully.\nExploitation relies on the device failing to properly validate certificate revocation status, thereby implicitly trusting compromised or revoked cryptographic roots.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling and maintenance of X.509 cryptographic root certificate stores embedded within the firmware of the affected SEIKO EPSON printers and scanners.\nSpecifically, the affected devices retain root certificates that have been officially revoked by their respective Certificate Authorities (CAs).\nBecause the device's TLS/SSL implementation relies on these outdated trust stores during the cryptographic handshake phase, it incorrectly establishes a secure session with endpoints utilizing certificates chained to the untrusted or compromised roots.\nThe vulnerable component is the device firmware's TLS stack and local certificate validation module.\nNetwork exposure is present whenever the affected printers and scanners communicate over insecure or untrusted local networks, or interact with external cloud services and update servers.\nNo authentication or elevated privilege requirements are strictly necessary for an external attacker to position themselves for a man-in-the-middle attack, provided they can spoof DNS, ARP poison, or otherwise intercept network traffic routed through the local network segment.\nThe attack flow proceeds as follows: First, the attacker establishes a network interception vector between the SEIKO EPSON product and its intended communication partner. Second, when the device initiates a TLS connection, the attacker presents a falsified or intercepted certificate chain.\nThird, because the device's trust store contains the revoked root certificate, the validation logic fails to detect the revocation or invalidity, resulting in successful validation of the malicious or spoofed certificate.\nFourth, a secure session is established between the device and the attacker without triggering security alerts or connection termination.\nFinally, the attacker decrypts, records, or modifies the communication data transmitted by the product, leading to the unauthorized disclosure of transit data such as print job contents, authentication tokens, and administrative configurations."
}