CVE-2026-23767 Missing authorization in ESC/POS
ESC/POS protocol lacks authentication and encryption, allowing attackers to execute arbitrary commands or modify data on compatible printers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-23767?
CVE-2026-23767 is a critical missing authorization vulnerability in Seiko Epson Corporation ESC/POS, published on 5 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ESC/POS, a printer control language designed by Seiko Epson Corporation, lacks mechanisms for user authentication and command authorization, does not provide controls to restrict sources or destinations of network communication, and transmits commands without encryption or integrity protection.
Weakness: CWE-306
Which versions are affected by CVE-2026-23767?
It affects 24 products.
Products include Epson Sb-H50 Firmware, Epson Tm-H6000v Firmware, Epson Tm-L100 Firmware, Epson Tm-M10 Firmware, Epson Tm-M30 Firmware, Epson Tm-M30ii-H Firmware and 18 more.
How do I fix CVE-2026-23767?
No fix has been published for CVE-2026-23767 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-23767 being exploited?
There is no known exploitation of CVE-2026-23767 in the wild and no public exploit code.
Sources
Also known as GHSA-57q8-p4r4-7xr7.