Insufficient hardening of the proxyuser account in the AiKaan IoT management platform, combined with the use of a shared, hardcoded SSH private key, allows remote attackers to authenticate to the cloud controller, gain interactive shell access, and pivot into other connected IoT devices. This can lead to remote code execution, information disclosure, and privilege escalation across customer environments.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Mon, 22 Sep 2025 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Insufficient hardening of the proxyuser account in the AiKaan IoT management platform, combined with the use of a shared, hardcoded SSH private key, allows remote attackers to authenticate to the cloud controller, gain interactive shell access, and pivot into other connected IoT devices. This can lead to remote code execution, information disclosure, and privilege escalation across customer environments. | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2025-09-22T15:24:53.074Z
Reserved: 2025-08-17T00:00:00.000Z
Link: CVE-2025-57602
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-09-22T16:15:45.130
Modified: 2025-09-22T16:15:45.130
Link: CVE-2025-57602
Redhat
No data.
OpenCVE Enrichment
No data.