CVE-2020-9453 - Vulnerability Details - OpenCVE

In Epson iProjection v2.30, the driver file EMP_MPAU.sys allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C402406 and IOCtl 0x9C40240A. (0x9C402402 has only a NULL pointer dereference.) This affects \Device\EMPMPAUIO and \DosDevices\EMPMPAU.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Complete

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Epson	Iprojection

Configuration 1 [-]

cpe:2.3:a:epson:iprojection:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://epson.com
https://epson.com/Support/wa00936
https://github.com/FULLSHADE/Kernel-exploits
https://github.com/FULLSHADE/Kernel-exploits/tree/master/EMP_MPAU.sys

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2021-02-05T19:07:26

Updated: 2024-08-04T10:26:16.293Z

Reserved: 2020-02-28T00:00:00

Link: CVE-2020-9453

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-02-05T20:15:13.230

Modified: 2024-11-21T05:40:40.337

Link: CVE-2020-9453

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "In Epson iProjection v2.30, the driver file EMP_MPAU.sys allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C402406 and IOCtl 0x9C40240A. (0x9C402402 has only a NULL pointer dereference.) This affects \\Device\\EMPMPAUIO and \\DosDevices\\EMPMPAU."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-06-08T23:38:18", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://epson.com"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/FULLSHADE/Kernel-exploits"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/FULLSHADE/Kernel-exploits/tree/master/EMP_MPAU.sys"}, {"tags": ["x_refsource_MISC"], "url": "https://epson.com/Support/wa00936"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2020-9453", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In Epson iProjection v2.30, the driver file EMP_MPAU.sys allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C402406 and IOCtl 0x9C40240A. (0x9C402402 has only a NULL pointer dereference.) This affects \\Device\\EMPMPAUIO and \\DosDevices\\EMPMPAU."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://epson.com", "refsource": "MISC", "url": "https://epson.com"}, {"name": "https://github.com/FULLSHADE/Kernel-exploits", "refsource": "MISC", "url": "https://github.com/FULLSHADE/Kernel-exploits"}, {"name": "https://github.com/FULLSHADE/Kernel-exploits/tree/master/EMP_MPAU.sys", "refsource": "MISC", "url": "https://github.com/FULLSHADE/Kernel-exploits/tree/master/EMP_MPAU.sys"}, {"name": "https://epson.com/Support/wa00936", "refsource": "MISC", "url": "https://epson.com/Support/wa00936"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T10:26:16.293Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://epson.com"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/FULLSHADE/Kernel-exploits"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/FULLSHADE/Kernel-exploits/tree/master/EMP_MPAU.sys"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://epson.com/Support/wa00936"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2020-9453", "datePublished": "2021-02-05T19:07:26", "dateReserved": "2020-02-28T00:00:00", "dateUpdated": "2024-08-04T10:26:16.293Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:epson:iprojection:*:*:*:*:*:*:*:*", "matchCriteriaId": "22794CD6-188A-4404-BC4E-5B1E8C16F7E8", "versionEndIncluding": "2.30", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In Epson iProjection v2.30, the driver file EMP_MPAU.sys allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C402406 and IOCtl 0x9C40240A. (0x9C402402 has only a NULL pointer dereference.) This affects \\Device\\EMPMPAUIO and \\DosDevices\\EMPMPAU."}, {"lang": "es", "value": "En Epson iProjection versi\u00f3n v2.30, el archivo del controlador EMP_MPAU.sys permite a usuarios locales causar una denegaci\u00f3n de servicio (BSOD) o posiblemente tener otro impacto no especificado debido a que no se comprueban los valores de entrada de IOCtl 0x9C402406 e IOCtl 0x9C40240A. (0x9C402402 s\u00f3lo presenta una desreferencia de puntero NULL.) Esto afecta a \\Device\\EMPMPAUIO y \\DosDevices\\EMPMPAU"}], "id": "CVE-2020-9453", "lastModified": "2024-11-21T05:40:40.337", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 4.9, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-02-05T20:15:13.230", "references": [{"source": "cve@mitre.org", "tags": ["Product"], "url": "https://epson.com"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://epson.com/Support/wa00936"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/FULLSHADE/Kernel-exploits"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/FULLSHADE/Kernel-exploits/tree/master/EMP_MPAU.sys"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://epson.com"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://epson.com/Support/wa00936"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/FULLSHADE/Kernel-exploits"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/FULLSHADE/Kernel-exploits/tree/master/EMP_MPAU.sys"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}