CVE-2025-64310CWE-307

CVE-2025-64310

Critical · published November 21, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
40.8
In the wild
Unconfirmed
What it is

🚨 An effortless brute force attack could expose your admin password due to unregulated login attempts in EPSON WebConfig! 🔥 Think of it like a hotel lobby without a front desk — anyone can keep trying various room keys until they find the right one, without any staff intervention to stop them. This flaw leaves your projector's admin access wide open to anyone willing to test their luck! With this vulnerability, an attacker could potentially gain unauthorized access to your EPSON projector's admin panel, allowing them to disrupt presentations, change settings, or even lock you out completely. The stakes are high, and the consequences could be absolutely devastating if sensitive settings are altered or if personal data is exposed!

Put simply

Think of it like a hotel lobby without a front desk — anyone can keep trying various room keys until they find the right one, without any staff intervention to stop them. This flaw leaves your projector's admin access wide open to anyone willing to test their luck! This flaw in EPSON WebConfig and Web Control allows an unlimited number of authentication attempts, making it trivial for an attacker to guess the administrative password using brute force methods. Without any lockout mechanism, the system remains vulnerable even after repeated failed login attempts.

What to do

With this vulnerability, an attacker could potentially gain unauthorized access to your EPSON projector's admin panel, allowing them to disrupt presentations, change settings, or even lock you out completely. The stakes are high, and the consequences could be absolutely devastating if sensitive settings are altered or if personal data is exposed! Immediately apply the latest firmware update from EPSON to address this security oversight. Implement a strong password policy and consider enabling account lockout after several failed login attempts to enhance security. Don't wait; this needs your attention now! You've got this! Follow these steps, and you’ll be on your way to securing your devices in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00484 · 40.8th percentile
Weakness
CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2025-11-21T08:16Z
References (3)
EPSS history
Timeline
  • 21 NOV 02:36Z
    EPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products do not restrict excessive authentication attempts
    cvelistv5