Epson Stylus SX510W Denial-of-Service Vulnerability via Improper Query Parameter Handling

A denial-of-service vulnerability has been identified in the Epson Stylus SX510W printer. The issue arises in the embedded web management service, which fails to correctly process consecutive ampersand characters in query parameters when the '/PRESENTATION/HTML/TOP/INDEX.HTML' endpoint is accessed. This flaw allows remote attackers to send malformed requests that disrupt input parsing or memory management, leading to the printer process crashing or the device powering off.

Impact

Exploitation of this vulnerability causes the printer to shut down or power off, creating a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by sending a request to the '/PRESENTATION/HTML/TOP/INDEX.HTML' endpoint with two or more consecutive ampersand characters in the query parameters. This can be done using a tool like curl.