SEIKO EPSON Printer Vulnerabilities Let Attackers Execute Arbitrary Code

A critical security vulnerability in SEIKO EPSON printer drivers for Windows has been identified, allowing malicious actors to execute arbitrary code with SYSTEM-level privileges. The vulnerability, tracked as CVE-2025-42598, was published by JPCERT/CC on April 28, 2025, and affects a wide range of printer driver installations when used in non-English language environments. EPSON Printer Driver […] The post SEIKO EPSON Printer Vulnerabilities Let Attackers Execute Arbitrary Code appeared first on Cyber Security News.

Apr 29, 2025 - 07:05

SEIKO EPSON Printer Vulnerabilities Let Attackers Execute Arbitrary Code

A critical security vulnerability in SEIKO EPSON printer drivers for Windows has been identified, allowing malicious actors to execute arbitrary code with SYSTEM-level privileges.

The vulnerability, tracked as CVE-2025-42598, was published by JPCERT/CC on April 28, 2025, and affects a wide range of printer driver installations when used in non-English language environments.

EPSON Printer Driver Vulnerability

The security flaw has been classified as “improper access permission settings” (CWE-276) and has received high severity ratings with a CVSS 3.1 Base Score of 7.8 and a CVSS 4.0 Base Score of 8.4.

This vulnerability specifically targets EPSON printer drivers installed on Windows operating systems when the software is configured in languages other than English.

Security researchers discovered that the vulnerability enables DLL hijacking, a technique where attackers can replace legitimate Dynamic Link Library (DLL) files with malicious versions.

When a Windows application loads these libraries without specifying a fully qualified path, the system follows a specific search order to locate the required DLL.

If attackers gain control of one of these directories in the search path, they can force the application to load their malicious DLL instead of the legitimate one.

“An attacker may execute arbitrary code with SYSTEM privilege on a Windows system on which the printer driver is installed,” stated the official vulnerability report.

“It is assumed that a user is directed to place a crafted DLL file in a location of the attacker’s choosing.”

The exploitation of this vulnerability requires user interaction, as indicated by the “UI:R” (User Interaction Required) component in the CVSS vector string.

However, once exploited, attackers gain full control over the affected system with the highest privileges, allowing them to access sensitive data, install malware, or establish persistence within the network.

DLL hijacking is not a new attack vector but remains potent. “DLL hijacking has been in circulation among cybercriminals since Windows 2000 launched,” noted cybersecurity experts.

The technique allows attackers to execute code under the context of the user running the application, which becomes particularly dangerous when applications run with elevated privileges.

Risk Factors	Details
Affected Products	SEIKO EPSON printer drivers for Windows OS
Impact	Arbitrary code execution
Exploit Prerequisites	– Printer driver must be installed or used in a language other than English- User must be tricked into placing a crafted DLL file in a specific location (DLL hijacking)- User interaction required
CVSS 3.1 Score	7.8 (HIGH)

Mitigations

According to SEIKO EPSON CORPORATION, users should apply countermeasures immediately.

The company recommends running the Epson Software Updater to download and install the “Security vulnerability patch” and the “Epson Printer Driver Security Support Tool”.

The vulnerability affects numerous EPSON printer drivers. Users can verify if their specific models are affected by consulting the information provided by SEIKO EPSON at their official support websites.

Microsoft has previously addressed similar vulnerabilities by modifying the DLL search order over time, but attackers continue to find ways to exploit these weaknesses.

Users experiencing printer permission issues should consider uninstalling and reinstalling drivers after applying the security updates.

Are you from the SOC and DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Start Now for Free.

The post SEIKO EPSON Printer Vulnerabilities Let Attackers Execute Arbitrary Code appeared first on Cyber Security News.