CVE-2026-23767

Critical

Published: 05 March 2026

Published

05 March 2026

Modified

09 March 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0007 20.4th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-23767 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Epson Sb-H50 Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SC-7 (Boundary Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SC-7 Boundary Protection good match

prevent

Monitors and controls communications at external boundaries to restrict unauthorized network access to the ESC/POS service, directly enabling IP filtering as recommended in vendor guidance to prevent remote command injection.

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations for access to system resources like the printer, addressing the complete lack of user authentication and command authorization in ESC/POS.

SC-8 Transmission Confidentiality and Integrity good match

prevent

Protects the confidentiality and integrity of transmitted ESC/POS commands using cryptography, directly mitigating the protocol's absence of encryption and integrity protection.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The vulnerability directly enables remote unauthenticated command execution against a network-exposed printer protocol (ESC/POS), matching the definition of exploiting a public-facing application to achieve arbitrary control.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

ESC/POS, a printer control language designed by Seiko Epson Corporation, lacks mechanisms for user authentication and command authorization, does not provide controls to restrict sources or destinations of network communication, and transmits commands without encryption or integrity protection.

Deeper analysisAI

CVE-2026-23767, published on 2026-03-05, is a critical vulnerability in ESC/POS, a printer control language designed by Seiko Epson Corporation. The flaw arises because ESC/POS lacks mechanisms for user authentication and command authorization, provides no controls to restrict sources or destinations of network communications, and transmits commands without encryption or integrity protection. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-306 (Missing Authentication for Critical Function), affecting network-enabled printers and compatible software that implement the protocol.

Any unauthenticated attacker with network access to an affected device can exploit this vulnerability with low complexity and no user interaction required. Exploitation allows remote attainment of high impacts on confidentiality, integrity, and availability, enabling attackers to send arbitrary ESC/POS commands that fully control the printer, such as printing malicious documents, manipulating hardware functions like paper cutting or tray ejection, or potentially disrupting device operations entirely.

Epson and JVN advisories provide mitigation guidance, including Epson's IP Filtering Guide at https://download4.epson.biz/sec_pubs/bs/pdf/IP_Filtering_Guide_en_revA.pdf, JVNTA97995322 at https://jvn.jp/en/ta/JVNTA97995322/, and an Epson support notice at https://www.epson.jp/support/misc_t/260305_oshirase.htm, which address restricting network access to prevent unauthorized command injection.