Latest Daikin Security Gateway vulnerability #
Daikin has disclosed via ICS Advisory ICSA-25-254-10 that its Security Gateway devices have a weak password recovery mechanism that could result in an authentication bypass. A remote, unauthenticated adversary can reset the device's password by sending a specially crafted POST request to the password reset API endpoint /api/settings/password/reset. Successful exploitation of this vulnerability resets the credentials to the default username Daikin and password Daikin, allowing an adversary to gain unauthorized access to the system. This vulnerability has been designated CVE-2025-10127 and has been rated critical with a CVSS score of 9.8.
The following versions are affected
- Security Gateway versions prior to and including application version (App) 100 and firmware version (Frm) 214
What is the impact? #
Successful exploitation of this vulnerability would allow an adversary to gain unauthorized access to the system.
Are updates or workarounds available? #
Daikin does not plan to release a patch for this vulnerability. The general recommendation is to limit network exposure for all control systems and devices. In general, control systems and devices should not be directly connected to the public Internet.
How to find potentially vulnerable systems with runZero #
From the Service inventory, use the following query to locate potentially vulnerable assets:
_asset.protocol:http AND protocol:http AND has:html.title AND html.title:="Security GW" AND has:favicon.ico.image.mmh3 AND favicon.ico.image.mmh3:="1417553504"
