CVE-2025-64310

CriticalCVSS 9.8/10Last modified Oct 18, 2026

Description

EPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products do not restrict excessive authentication attempts. An administrative user's password may be identified through a brute force attack.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-307

Affected software

Vendor	Product	Versions
SEIKO EPSON CORPORATION	EPSON WebConfig for SEIKO EPSON Projector Products	see the information provided by the vendor
SEIKO EPSON CORPORATION	Epson Web Control for SEIKO EPSON Projector Products	see the information provided by the vendor

References

Timeline

Published: Nov 21, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-643115.5Permission control vulnerability in the Notepad module. Impact: Successful exploitation of this vulnerability may affect service confidentia CVE-2025-643127.5Permission control vulnerability in the file management module. Impact: Successful exploitation of this vulnerability may affect service con CVE-2025-643135.5Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2025-643145.5Permission control vulnerability in the memory management module. Impact: Successful exploitation of this vulnerability may affect confident CVE-2025-643157.1Configuration defect vulnerability in the file management module. Impact: Successful exploitation of this vulnerability may affect app data CVE-2025-643185.3Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Write CVE-2025-643195.3Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeab CVE-2025-64328.6When Multi-Account Containers was enabled, DNS requests could have bypassed a SOCKS proxy when the domain name was invalid or the SOCKS prox CVE-2025-643206.5Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Code Injection.This is CVE-2025-643215.3Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable CVE-2025-643225.3Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable C CVE-2025-643235.3kgateway is a Cloud-Native API and AI Gateway. Versions 2.0.4 and below and 2.1.0-agw-cel-rbac through 2.1.0-rc.2 lack authentication, allow