CVE-2025-10127
Daikin Europe N.V Security Gateway Weak Password Recovery Mechanism for Forgotten Password
Security Gateway is vulnerable to an authorization bypass through
a user-controlled key vulnerability that could allow an attacker to
bypass authentication. An unauthorized attacker could access the system
without prior credentials.
Affected Products
-
CVE record
-
NVD configurations
No data
-
Red Hat packages
No data
-
OpenCVE enrichment
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Daikin Europe N.V | Security Gateway | unaffected |
|
No data.
No data.
| Vendor | Product | Versions |
|---|---|---|
| Daikin | Security Gateway | — |
Remediation
Vendor Workaround
Daikin Europe N.V has reported they will not fix this vulnerability and will respond directly to user inquiries. For more information, contact Daikin customer support https://www.daikin.eu/en_us/customers/support.html .
Tracking
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2025-28991 | Daikin Europe N.V Security Gateway is vulnerable to an authorization bypass through a user-controlled key vulnerability that could allow an attacker to bypass authentication. An unauthorized attacker could access the system without prior credentials. |
Metrics
Attack Vector Network
Attack Complexity Low
Privileges Required None
Attack Requirements None
User Interaction None
Vulnerable System Confidentiality Impact Low
Vulnerable System Integrity Impact Low
Vulnerable System Availability Impact High
Subsequent System Confidentiality Impact None
Subsequent System Integrity Impact None
Subsequent System Availability Impact Low
Attack Vector Network
Attack Complexity Low
Privileges Required None
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact High
User Interaction None
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.652% probability within 30 days)
Exploitation none
Automatable yes
Technical Impact total
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Daikin Security Gateway is vulnerable to an authorization bypass through a user-controlled key vulnerability that could allow an attacker to bypass authentication. An unauthorized attacker could access the system without prior credentials. | Daikin Europe N.V Security Gateway is vulnerable to an authorization bypass through a user-controlled key vulnerability that could allow an attacker to bypass authentication. An unauthorized attacker could access the system without prior credentials. |
| Title | Daikin Security Gateway Weak Password Recovery Mechanism for Forgotten Password | Daikin Europe N.V Security Gateway Weak Password Recovery Mechanism for Forgotten Password |
| Metrics |
cvssV3_1
|
cvssV3_1
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Daikin
Daikin security Gateway |
|
| Vendors & Products |
Daikin
Daikin security Gateway |
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Daikin Security Gateway is vulnerable to an authorization bypass through a user-controlled key vulnerability that could allow an attacker to bypass authentication. An unauthorized attacker could access the system without prior credentials. | |
| Title | Daikin Security Gateway Weak Password Recovery Mechanism for Forgotten Password | |
| Weaknesses | CWE-640 | |
| References |
| |
| Metrics |
cvssV3_1
|
