Medium severity · published Nov 17, 2025
CVE-2025-13164
Digiwin｜EasyFlow GP - Insufficiently Protected Credentials
4.9
CVSS
0.4%
EPSS
No
On KEV
Description
EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain plaintext credentials of AD and system mail from the system frontend.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EG
EasyFlow GP · Digiwin
5.8.8.3 through 5.8.11.1.0810112 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-13164
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-13164
www.twcert.org.tw
https://www.twcert.org.tw/en/cp-139-10504-23f4c-2.html
www.twcert.org.tw
https://www.twcert.org.tw/tw/cp-132-10503-a66fe-1.html
More from EasyFlow GP
7.5
CVE-2025-13165
Digiwin｜EasyFlow GP - Denial of service
4.9
CVE-2025-13163
Digiwin｜EasyFlow GP - Insufficiently Protected Credentials