CVE-2025-13164: Digiwin｜EasyFlow GP - Insufficiently Protected Credentials

Published Nov 17, 2025

Updated

EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain plaintext credentials of AD and system mail from the system frontend.

Affected Software

1 affected component

Digiwin EasyFlow GP

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Digiwin EasyFlow GP to a version that resolves this vulnerability.
Fixed in 5.8.11.1.081013

Event History

Nov 17, 2025

CVE Published

via MITRE·06:23 AM

Data Sourced

via MITRE·06:23 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-13164?

CVE-2025-13164 is rated as a high-severity vulnerability due to its potential for credential exposure.

How do I fix CVE-2025-13164?

To mitigate CVE-2025-13164, ensure that all sensitive credentials are securely stored and not easily accessible through the system frontend.

Who is affected by CVE-2025-13164?

CVE-2025-13164 affects users of Digiwin EasyFlow GP software.

What type of attack does CVE-2025-13164 enable?

CVE-2025-13164 enables privileged remote attackers to obtain plaintext credentials from the system.

Is CVE-2025-13164 a local or remote vulnerability?

CVE-2025-13164 is a remote vulnerability, allowing attackers to exploit it from offsite.