Cyber Posture

CVE-2025-64310

Critical

Published: 21 November 2025

Published
21 November 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0009 24.8th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts.

Security Summary

CVE-2025-64310 is a critical vulnerability in EPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products, published on 2025-11-21. It stems from CWE-307: Improper Restriction of Excessive Authentication Attempts, where the web interfaces fail to limit login attempts, allowing attackers to brute-force administrative user passwords. The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its high severity due to network accessibility and potential for complete compromise.

Any unauthenticated attacker with network access to the projector can exploit this vulnerability remotely with low complexity and no user interaction required. By repeatedly attempting logins with guessed credentials, they can identify the administrative password, achieving high-impact unauthorized access that enables full control over confidentiality, integrity, and availability of the device.

Advisories detailing mitigations and patches are available from the Japan Vulnerability Notes (JVN) at https://jvn.jp/en/vu/JVNVU95021911/, Epson UK at https://www.epson.co.uk/en_GB/faq/KA-02041/contents?loc=en-us, and Epson Japan at https://www.epson.jp/support/misc_t/251120_oshirase.htm. Security practitioners should review these resources promptly for update instructions and protective measures.

Details

CWE(s)
CWE-307

MITRE ATT&CK Enterprise Techniques

T1110 Brute Force Credential Access
Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.
T1110.001 Password Guessing Credential Access
Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts.
Why these techniques?

The vulnerability is a failure to restrict excessive authentication attempts (CWE-307), directly enabling brute force password guessing (T1110, T1110.001) on the administrative interface.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References