The Bematech MP-4200 TH thermal printer is susceptible to a remote denial of service attack that can crash the device web service.

This vulnerability is caused by improper handling of user-supplied input in the admin configuration page. An unauthenticated attacker can send crafted POST requests with malformed admin and person parameters to trigger an uncontrolled resource consumption condition, resulting in a system crash.

Successful exploitation of this vulnerability results in a denial of service, rendering the printer unresponsive and requiring a manual reboot to restore functionality. Given the reliance on receipt printers for point of sale operations, this could lead to significant business disruption and operational downtime. The CVSS score of 7.5 reflects the high impact on availability, particularly for devices deployed in public-facing or accessible network environments.

Immediate Action: Since no official patch is currently identified, isolate the printer management interface from public or untrusted networks immediately.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /en/conf_admin.html endpoint, especially those containing excessively long strings in the admin or person fields.

Compensating Controls: Implement access control lists or a Web Application Firewall (WAF) to restrict access to the printer administrative interface to authorized management IP addresses only.

Public Exploit Available: Yes, a proof of concept exploit is available via the Exploit Database (EDB-ID: 47648).

Given the availability of a public proof of concept and the potential for operational disruption, organizations using Bematech MP-4200 TH printers must treat this as a high priority. Ensure that the administrative web interface is not exposed to the internet and restrict access to internal management subnets. If the vendor does not provide a firmware update, replacing the device or permanently disabling the web management feature is recommended to eliminate the risk of service interruption.