Vulnerability in EPSON WebConfig/Epson Web Control for Projector Products

Vulnerability Reference: CVE-2025-64310

Description: The password authentication (Web Control Password and Remote Password) of the affected products listed below does not have a restriction or lockout mechanism.

Impact: An attacker can try an unlimited number of passwords, making the projector vulnerable to brute-force attacks. If the Web Control Password or Remote Password are discovered through the brute-force attack, a third party may be able to take control of the projector and perform the following:

• Operate the projector: turn on or off, change input source, etc.
• Edit content stored on a USB flash drive or SD card attached to the projector (for models that support Content Playback mode).
• Capture projected images using Remote Camera Access (for models that support this feature).
• View projector log files saved on a USB flash drive (for models that support Log Save functionality).

Currently, there are no reports of any attacks exploiting this vulnerability.

Solution: Countermeasure firmware will be released as shown below. After the firmware is released, we strongly recommend that you download it from the Epson website and apply the update.

For products without available firmware updates, we strongly recommend implementing one of the two workaround methods outlined below.

Workaround Method 1

Configure the projector according to the user’s guide:

• The product should not be directly connected to the Internet and should be installed on a network protected by a firewall.
• Set the Web Control Password and Remote Password for each product.
• The Web Control Password and Remote Password should be a complex string that is difficult for others to guess, mixing English characters, symbols, and numbers, with at least 8 characters.

Workaround Method 2

Block HTTP access to the product:

• Block HTTP access (TCP/80 port and TCP/443 port) to the product using a network device (router or switch). Open the port only when you need to update the application settings or firmware.

Affected Models and Solution: