Epson Printer Controller Installer
Approved changes feed: RSS · Atom
cpe:2.3:a:epson:epson_printer_controller_installer:*:*:*:*:*:*:*:0
part: a version: * update: *
| Vendor | Epson (2b370a58-1ea1-55ec-ba0d-8bb9e2673430) |
|---|---|
| Product | Epson Printer Controller Installer (6a60b63a-f7bd-5f27-9f1e-24223a5e3f05) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | 0 |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-4960 |
vulnerable | 2026-06-08 07:29:17.594684 |
macOS Local Privilege Escalation via Improper Authorization Handling in EPSON Printer Controller Installer
HIGH (7.8)
The com.epson.InstallNavi.helper tool, deployed with the EPSON printer driver installer, contains a local privilege escalation vulnerability due to multiple flaws in its implementation. It fails to properly authenticate clients over the XPC protocol and does not correctly enforce macOS’s authorization model, exposing privileged functionality to untrusted users. Although it invokes the AuthorizationCopyRights API, it does so using overly permissive custom rights that it registers in the system’s authorization database (/var/db/auth.db).
These rights can be requested and granted by the authorization daemon to any local user, regardless of privilege level. As a result, an attacker can exploit the vulnerable service to perform privileged operations such as executing arbitrary commands or installing system components without requiring administrative credentials.
Published: 2026-02-19T01:37:22.018Z
Updated: 2026-02-24T01:47:09.720Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.