CVE-2025-35970

On multiple products of SEIKO EPSON and FUJIFILM Corporation, the initial administrator password is easy to guess from the information available via SNMP. If the administrator password is not changed from the initial one, a remote attacker with SNMP access can log in to the product with the administrator privilege.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://global.fujifilm.com/en/news/hq/697e
https://jvn.jp/en/vu/JVNVU91363496/
https://www.epson.jp/support/misc_t/250807_oshirase.htm

Configurations

No configuration.

History

07 Aug 2025, 21:26

Type	Values Removed	Values Added
Summary		(es) En varios productos de SEIKO EPSON y FUJIFILM Corporation, la contraseña inicial del administrador es fácil de adivinar a partir de la información disponible a través de SNMP. Si no se cambia la contraseña inicial, un atacante remoto con acceso a SNMP podría iniciar sesión en el producto con privilegios de administrador.

07 Aug 2025, 06:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-07 06:15

Updated : 2025-08-07 21:26

NVD link : CVE-2025-35970

Mitre link : CVE-2025-35970

CVE.ORG link : CVE-2025-35970

JSON object : View

Products Affected

No product.

CWE

CWE-1391

{"id": "CVE-2025-35970", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "vultures@jpcert.or.jp", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "vultures@jpcert.or.jp", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-08-07T06:15:42.447", "references": [{"url": "https://global.fujifilm.com/en/news/hq/697e", "source": "vultures@jpcert.or.jp"}, {"url": "https://jvn.jp/en/vu/JVNVU91363496/", "source": "vultures@jpcert.or.jp"}, {"url": "https://www.epson.jp/support/misc_t/250807_oshirase.htm", "source": "vultures@jpcert.or.jp"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "vultures@jpcert.or.jp", "description": [{"lang": "en", "value": "CWE-1391"}]}], "descriptions": [{"lang": "en", "value": "On multiple products of SEIKO EPSON and FUJIFILM Corporation, the initial administrator password is easy to guess from the information available via SNMP. If the administrator password is not changed from the initial one, a remote attacker with SNMP access can log in to the product with the administrator privilege."}, {"lang": "es", "value": "En varios productos de SEIKO EPSON y FUJIFILM Corporation, la contrase\u00f1a inicial del administrador es f\u00e1cil de adivinar a partir de la informaci\u00f3n disponible a trav\u00e9s de SNMP. Si no se cambia la contrase\u00f1a inicial, un atacante remoto con acceso a SNMP podr\u00eda iniciar sesi\u00f3n en el producto con privilegios de administrador."}], "lastModified": "2025-08-07T21:26:37.453", "sourceIdentifier": "vultures@jpcert.or.jp"}