Vulnerability Reference: CVE-2025-35970
Description: It is possible to discover the initial Epson WebConfig administrator password which is defaulted to the product’s serial number. If users do not change the default password, a remote attacker with SNMP access can potentially gain unauthorized administrator privileges, leading to significant security risks. Organizations utilizing these products are strongly advised to modify the initial password to mitigate this vulnerability.
Impact: If the administrator password is not changed from the initial one, a remote attacker with SNMP access can log in to the product with the administrator privilege.
Solution: Apply one of the following workarounds to mitigate the impact of this vulnerability.
- Change the administrator password, and manage it appropriately
- Connect the product to a firewall-protected network
- Connect the product to a network with a private IP address
For more information on securing your Epson product visit our Security Guidebook.