← Advisories

Daikin Security Gateway v214 Remote Password Reset

Critical
Advisory ID
ZSL-2025-5931
Release Date
28 April 2025
Vendor
Daikin Industries, Ltd. - https://www.daikin.com
Affected Version
App: 100, Frm: 214
Tested On
fasthttp
Summary

The Security gateway allows the iTM and LC8 controllers to connect through the Security gateway to the Daikin Cloud Service. Instead of sending the report to the router directly, the iTM or LC8 controller sends the report to the Security gateway first. The Security gateway transforms the report format from http to https and then sends the transformed https report to the Daikin Cloud Service via the router. Built-in LAN adapter enabling online control.

Description

The Daikin Security Gateway exposes a critical vulnerability in its password reset API endpoint. Due to an IDOR flaw, an unauthenticated attacker can send a crafted POST request to this endpoint, bypassing authentication mechanisms. Successful exploitation resets the system credentials to the default Daikin:Daikin username and password combination. This allows attackers to gain unauthorized access to the system without prior credentials, potentially compromising connected devices and networks.

Proof of Concept
Disclosure Timeline
21.03.2025Vulnerability discovered.
21.03.2025Vendor contacted.
27.04.2025No response from the vendor.
28.04.2025Public security advisory released.
08.09.2025Vendor will not make the fix and not publish any information for this issue. If inquiry from users, will respond individually.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
28.04.2025Initial release
29.04.2025Added reference [1]
09.05.2025Added reference [2]
26.05.2025Added reference [3]
11.09.2025Added reference [4] and [5]
18.09.2025Added vendor status and reference [6]