Great write up and reverse engineering of firmware! I hope to see Epson MFC inkjet printers to have similar discovery too (perhaps it literally a prompt away with a link to this article).

I was digging around an epson receipt printers firmware recently; got as far as discovering http endpoints (hardcoded auth) to remotely enable ssh (but not login), and some other diagnostic access. They seem fairly well put together.