Administrative takeover via unclaimed initial password

Insecure initial password configuration in Seiko Epson Web Config allows remote attackers to obtain device administration over a network. On a device whose Web Config settings were never initialized, the first network visitor can assign the blank administrator credential without prior authentication. The device must be network-connected and still unconfigured; successful exploitation grants administrative control over device settings and operation.