PT-2025-38731 · Unknown · Aikaan Iot Management Platform

Published 2025-09-22 · Updated 2025-09-22 · CVE-2025-57602

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AiKaan IoT management platform (affected versions not specified)

Description The AiKaan IoT management platform suffers from inadequate hardening of the proxyuser account and utilizes a shared, hardcoded SSH private key. This combination enables remote attackers to authenticate to the cloud controller, obtain interactive shell access, and move laterally to other connected IoT devices. Successful exploitation can result in remote code execution, information disclosure, and privilege escalation within customer environments. The proxyuser account is a key component in the attack chain.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-57602

Affected Products

Aikaan Iot Management Platform

References · 3

• 🔥 https://github.com/Shubhangborkar/aikaan-vulnerabilities/blob/main/cve2-proxyuser-shell.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-57602 · Security Note
• https://twitter.com/CVEnew/status/1970153794055876712 · Twitter Post