PT-2025-38732 · Unknown · Aikaan Iot Platform

Published 2025-09-22 · Updated 2025-09-22 · CVE-2025-57605

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AiKaan IoT Platform (affected versions not specified)

Description A missing server-side authorization check in the department admin assignment APIs within the AiKaan IoT Platform permits authenticated users to gain elevated privileges. Specifically, users can assign themselves as administrators of departments they do not have authorization to manage, leading to unauthorized privilege escalation. The affected API endpoints handle department admin assignments. The vulnerable functionality allows users to manipulate their department admin status.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-57605

Affected Products

Aikaan Iot Platform

References · 3

• 🔥 https://github.com/Shubhangborkar/aikaan-vulnerabilities/blob/main/cve5-department-switch.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-57605 · Security Note
• https://twitter.com/CVEnew/status/1970153795196776935 · Twitter Post