CVE-2026-23767
Published: 05 March 2026
Summary
CVE-2026-23767 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Epson Sb-H50 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SC-7 (Boundary Protection).
Deeper analysis
CVE-2026-23767, published on 2026-03-05, is a critical vulnerability in ESC/POS, a printer control language designed by Seiko Epson Corporation. The flaw arises because ESC/POS lacks mechanisms for user authentication and command authorization, provides no controls to restrict sources or destinations of network communications, and transmits commands without encryption or integrity protection. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-306 (Missing Authentication for Critical Function), affecting network-enabled printers and compatible software that implement the protocol.
Any unauthenticated attacker with network access to an affected device can exploit this vulnerability with low complexity and no user interaction required. Exploitation allows remote attainment of high impacts on confidentiality, integrity, and availability, enabling attackers to send arbitrary ESC/POS commands that fully control the printer, such as printing malicious documents, manipulating hardware functions like paper cutting or tray ejection, or potentially disrupting device operations entirely.
Epson and JVN advisories provide mitigation guidance, including Epson's IP Filtering Guide at https://download4.epson.biz/sec_pubs/bs/pdf/IP_Filtering_Guide_en_revA.pdf, JVNTA97995322 at https://jvn.jp/en/ta/JVNTA97995322/, and an Epson support notice at https://www.epson.jp/support/misc_t/260305_oshirase.htm, which address restricting network access to prevent unauthorized command injection.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9594
Vulnerability details
ESC/POS, a printer control language designed by Seiko Epson Corporation, lacks mechanisms for user authentication and command authorization, does not provide controls to restrict sources or destinations of network communication, and transmits commands without encryption or integrity protection.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability directly enables remote unauthenticated command execution against a network-exposed printer protocol (ESC/POS), matching the definition of exploiting a public-facing application to achieve arbitrary control.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Monitors and controls communications at external boundaries to restrict unauthorized network access to the ESC/POS service, directly enabling IP filtering as recommended in vendor guidance to prevent remote command injection.
Enforces approved authorizations for access to system resources like the printer, addressing the complete lack of user authentication and command authorization in ESC/POS.
Protects the confidentiality and integrity of transmitted ESC/POS commands using cryptography, directly mitigating the protocol's absence of encryption and integrity protection.