EPSON WF-2750 Improper Neutralization of Input During Web Page Generation (CVE-2018-14899)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505070);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/06");

  script_cve_id("CVE-2018-14899");

  script_name(english:"EPSON WF-2750 Improper Neutralization of Input During Web Page Generation (CVE-2018-14899)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"On the EPSON WF-2750 printer with firmware JP02I2, the Web interface
AirPrint Setup page is vulnerable to HTML Injection that can redirect
users to malicious sites.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://www.vdalabs.com/2018/08/26/epson-printer-vulnerabilities/");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-14899");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(79);

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/08/30");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/08/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/05");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:epson:wf-2750_firmware:jp02l2");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/EPSON");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/EPSON');

var asset = tenable_ot::assets::get(vendor:'EPSON');

var vuln_cpes = {
    "cpe:/o:epson:wf-2750_firmware:jp02l2" :
        {"versionEndIncluding" : "jp02l2", "versionStartIncluding" : "jp02l2", "family" : "EPSON"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);