CVE-2025-10127 (CVSS 9.8): Critical Daikin Flaw Could Give Hackers Full System Access

CVE-2025-10127 (CVSS 9.8) is a critical flaw in Daikin Security Gateway devices that could allow attackers to bypass authentication and gain full system access, according to CISA. The advisory notes an authorization bypass through a user‑controlled key vulnerability, meaning an unauthorised attacker could access the system without prior credentials. The issue is linked to a weak password recovery mechanism for forgotten passwords (CWE-640), and the affected version is Daikin Security Gateway: App 100, Frm 214.

A public Proof of Concept exists, and Daikin has stated it will not release a patch, advising organisations to respond directly to user inquiries and implement their own mitigations. As of now, there have been no reports of active exploitation in the wild, though the PoC publicly available raises the likelihood of future targeting of exposed systems.

CISA urges users to reduce exposure by minimising internet access to control system devices, locating them behind firewalls, and using VPNs for remote access with up‑to‑date security.