Authentication Bypass in EPSON EH-TW5350 Firmware

Executive Summary

CVE-2021-43718 is an authentication bypass vulnerability in the Epson EH-TW5350 projector with firmware version 150075647YWWV110. It allows remote attackers on the same network to control the device without authentication by exploiting endpoints under /cgi-bin/ that lack proper access checks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, scan your network for Epson EH-TW5350 projectors with firmware version 150075647YWWV110. Check if unauthenticated HTTP requests to /cgi-bin/directsend or /cgi-bin/webconf return privileged responses. Use tools like curl to send test requests to these endpoints without authentication.

Useful 0 Not Useful 0

Impact Analysis

An attacker could power the projector on or off, change input sources, adjust volume, mute audio, or access administrative settings. This could disrupt presentations or allow unauthorized control of the device.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it involves an authentication bypass in a network projector's web interface. However, if the projector is used in environments handling sensitive data (e.g., healthcare for HIPAA or personal data for GDPR), unauthorized access could lead to breaches of confidentiality or integrity, potentially violating these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the projector firmware to a patched version that enforces authentication on all /cgi-bin/ endpoints. If no patch is available, restrict network access to the projector via firewall rules or isolate it on a dedicated VLAN. Disable unnecessary services like the Web Control interface if possible.

Useful 0 Not Useful 0