Epson Sicherheitshinweise und Benachrichtigungen

Epson Vulnerability Disclosure Policy

Seiko Epson Corporation and its sales companies ("we", "us", "our") are eager to collect information on security vulnerabilities in our "Epson Brand" products and services (the "Products"), investigate their impact and disclose information as necessary to ensure that our customers can use our Products with confidence.

In addition, based on the principles of Coordinated Vulnerability Disclosure (CVD), we will work in cooperation with reporters and relevant stakeholders in handling vulnerabilities, and we will not take legal action against reporters who act in good faith in accordance with this policy.

In this respect, is the aim of this coordinated vulnerability disclosure policy to detail a structured process through which vulnerabilities can be reported by any individual or entity (also referred herein as a “reporter") to us in a manner allowing us to diagnose and remedy such vulnerabilities before detailed vulnerability information is disclosed to third parties or to the public.

1. Application

This policy applies to all vulnerabilities (*1) reported to us. Reporters are requested to read and comply with this policy carefully before reporting vulnerabilities.

*1: Vulnerability is a weakness, susceptibility or flaw in an Epson-branded product with digital elements that can be exploited by a cyber threat, potentially affecting the confidentiality, integrity, authenticity or availability of data, systems, or function".

2. How to report vulnerabilities

If you wish to report a vulnerability (undisclosed vulnerability) for one of our products, please submit a report via the link below.

Report a Vulnerability

3. The process after a vulnerability report

3.1 Acknowledgement of receipt

The reporter submitting the report will receive an acknowledgement of receipt from us within five working days, starting from the day after the day on which the report is sent.

3.2 Identification of vulnerabilities

The received vulnerabilities are checked by our technical team and the results are fed back to the reporter. If there are any unclear points in the reported vulnerability information, we will contact you using your specified method of communication.

In some cases, we may decide that the vulnerability is "not covered by the vulnerability response". For example, in the following cases.

1. Known vulnerabilities.
2. Product support is no longer available.

3.3 Addressing vulnerabilities

If we determine that there is a vulnerability in our product , we will provide a remedy with a fixed module that addresses the vulnerability or provide a workaround as quickly as possible. Please note that when we provide a fixed module, we may ask the reporter to confirm that the vulnerability has been properly addressed.

3.4 Vulnerability disclosure.

If it is deemed necessary to inform third parties or the public, the security advisory will be posted on the following website once appropriate mitigation measures are available to reduce potential risk, so that customers can implement appropriate measures.

In addition, if the reporter makes the disclosure, the reporter is requested to coordinate the content of the disclosure (e.g. not including information that may give the attacker an advantage) and the schedule of the disclosure.

Security Advisory

4. About Rewards

We sincerely appreciate those who take the time and effort to report vulnerabilities in accordance with this policy, but we do not offer any compensation for reporting vulnerabilities.

5. Code of Conduct

• With regard to the disclosure of vulnerabilities: We kindly request that the reporter shall not disclose vulnerability-related information to third parties without a valid reason. 
  However, if you need to disclose vulnerability-related information for legitimate reasons, please consult us in advance.
• With regard to when vulnerabilities are discovered and verified: Please do not do the following in order to search for and verify vulnerabilities:
  1. Violating applicable laws and regulations
  2. Accessing unnecessary, excessive or voluminous data
  3. Altering data on our systems or services
  4. Using high-intensity invasive or destructive scanning tools to discover vulnerabilities
  5. Attempting or reporting any form of denial of service, such as overwhelming our services with a high volume of requests
  6. Interfering with our services or systems

Ab dem 1. August 2025 müssen alle drahtlosen Geräte, die auf den Märkten der EU, des Vereinigten Königreichs und der EFTA angeboten werden, der aktualisierten Funkgeräterichtlinie (Radio Equipment Directive, RED) entsprechen. „Auf dem Markt angeboten” bezieht sich auf den Zeitpunkt, zu dem ein Gerät in die Region gelangt ist und die Zollabfertigung abgeschlossen wurde.

Was ist das Ziel?

So stellen Sie sicher, dass bei den Geräten folgendes gewährleistet ist:

• Sicher in der Anwendung
• Schutz vor Cyber-Bedrohungen
• Kompatibel mit anderen Technologien
• Effizienter Einsatz von Funkfrequenzen

Was ist abgedeckt?

Elektronische Geräte im Sinne der Richtlinie sind solche, die entweder selbst Radiowellen absichtlich senden und empfangen oder Zubehör enthalten, das diese Funktion zur Kommunikation ermöglicht. Im Allgemeinen fällt ein Gerät, das aktiv den Datenaustausch mit dem Internet initiiert, in den Anwendungsbereich von RED.

Beispiele sind unter anderem:

• Drucker mit Wi-Fi-Funktionalität, Projektoren und Scanner
• Telefone
• Wi-Fi/Bluetooth-Geräte
• GPS
• Radios

Warum es wichtig ist:

Hersteller müssen Daten verschlüsseln, die Privatsphäre der Benutzer schützen und strenge Sicherheitsstandards erfüllen.

Weitere Informationen:

Erfahren Sie, wie sich RED auf Ihr Epson Gerät auswirkt, indem Sie auf die Schaltfläche „Mehr erfahren” klicken.

Mehr erfahren

RED-Richtlinie — Häufig gestellte Fragen

Allgemein

Probleme mit neuen Druckern