CVE-2025-66635

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-66635", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2025-12-10T06:27:24.088Z", "datePublished": "2025-12-16T06:59:25.611Z", "dateUpdated": "2025-12-22T02:27:45.711Z"}, "containers": {"cna": {"affected": [{"vendor": "SEIKO EPSON CORPORATION", "product": "Web Config", "versions": [{"version": "See the information/details provided by the vendor", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Stack-based buffer overflow vulnerability exists in SEIKO EPSON Web Config. Specially crafted data input by a logged-in user may execute arbitrary code. As for the details of the affected products and versions, see the information provided by the vendor under [References]."}], "problemTypes": [{"descriptions": [{"description": "Stack-based buffer overflow", "lang": "en-US", "cweId": "CWE-121", "type": "CWE"}]}], "references": [{"url": "https://www.epson.jp/support/misc_t/251216_oshirase.htm"}, {"url": "https://epson.com/Support/wa00971"}, {"url": "https://jvn.jp/en/jp/JVN51846148/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_0": {"version": "3.0", "baseSeverity": "HIGH", "baseScore": 7.2, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.6, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2025-12-22T02:27:45.711Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-16T21:32:37.175744Z", "id": "CVE-2025-66635", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-16T21:32:43.584Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-66635", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-16T21:32:37.175744Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-16T21:32:40.850Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "SEIKO EPSON CORPORATION", "product": "Web Config", "versions": [{"status": "affected", "version": "See the information/details provided by the vendor"}]}], "references": [{"url": "https://www.epson.jp/support/misc_t/251216_oshirase.htm"}, {"url": "https://epson.com/Support/wa00971"}, {"url": "https://jvn.jp/en/jp/JVN51846148/"}], "descriptions": [{"lang": "en", "value": "Stack-based buffer overflow vulnerability exists in SEIKO EPSON Web Config. Specially crafted data input by a logged-in user may execute arbitrary code. As for the details of the affected products and versions, see the information provided by the vendor under [References]."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-121", "description": "Stack-based buffer overflow"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2025-12-22T02:27:45.711Z"}}}, "cveMetadata": {"cveId": "CVE-2025-66635", "state": "PUBLISHED", "dateUpdated": "2025-12-22T02:27:45.711Z", "dateReserved": "2025-12-10T06:27:24.088Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2025-12-16T06:59:25.611Z", "assignerShortName": "jpcert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Web Config", "vendor": "SEIKO EPSON CORPORATION", "versions": [{"status": "affected", "version": "See the information/details provided by the vendor"}]}], "source": "vultures@jpcert.or.jp"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Stack-based buffer overflow vulnerability exists in SEIKO EPSON Web Config. Specially crafted data input by a logged-in user may execute arbitrary code. As for the details of the affected products and versions, see the information provided by the vendor under [References]."}, {"lang": "es", "value": "Existe una vulnerabilidad de desbordamiento de b\u00fafer basado en pila en SEIKO EPSON Web Config. Una entrada de datos especialmente dise\u00f1ada por un usuario que ha iniciado sesi\u00f3n puede ejecutar c\u00f3digo arbitrario. En cuanto a los detalles de los productos y versiones afectados, consulte la informaci\u00f3n proporcionada por el proveedor en [Referencias]."}], "id": "CVE-2025-66635", "lastModified": "2026-10-07T19:10:00.160", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66635", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-16T21:32:37.175744Z", "version": "2.0.3"}}]}, "published": "2025-12-16T07:15:54.480", "references": [{"source": "vultures@jpcert.or.jp", "url": "https://epson.com/Support/wa00971"}, {"source": "vultures@jpcert.or.jp", "url": "https://jvn.jp/en/jp/JVN51846148/"}, {"source": "vultures@jpcert.or.jp", "url": "https://www.epson.jp/support/misc_t/251216_oshirase.htm"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "vultures@jpcert.or.jp", "type": "Secondary"}]}

{}

{"created": "2025-12-16T17:09:25.501808+00:00", "updated": "2025-12-16T17:09:25.501845+00:00", "vendors": ["seiko_epson_corporation", "seiko_epson_corporation$PRODUCT$web_config"]}