CVE-2025-57601

Full vulnerability record from the local CVENow database.

Description

AiKaan Cloud Controller uses a single hardcoded SSH private key and the username `proxyuser` for remote terminal access to all managed IoT/edge devices. When an administrator initiates "Open Remote Terminal" from the AiKaan dashboard, the controller sends this same static private key to the target device. The device then uses it to establish a reverse SSH tunnel to a remote access server, enabling browser-based SSH access for the administrator. Because the same `proxyuser` account and SSH key are reused across all customer environments: - An attacker who obtains the key (e.g., by intercepting it in transit, extracting it from the remote access server, or from a compromised admin account) can impersonate any managed device. - They can establish unauthorized reverse SSH tunnels and interact with devices without the owner's consent. This is a design flaw in the authentication model: compromise of a single key compromises the trust boundary between the controller and devices.

Severity

CRITICAL

CVSS score

9.8 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2025-09-22 16:15:45

Last modified

2026-11-05 23:10:00.150000

View original CVE JSON

{
  "id": "CVE-2025-57601",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-22T16:15:45.000",
  "lastModified": "2026-11-05T23:10:00.150",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "AiKaan Cloud Controller uses a single hardcoded SSH private key and the username `proxyuser` for remote terminal access to all managed IoT/edge devices. When an administrator initiates \"Open Remote Terminal\" from the AiKaan dashboard, the controller sends this same static private key to the target device. The device then uses it to establish a reverse SSH tunnel to a remote access server, enabling browser-based SSH access for the administrator. Because the same `proxyuser` account and SSH key are reused across all customer environments: - An attacker who obtains the key (e.g., by intercepting it in transit, extracting it from the remote access server, or from a compromised admin account) can impersonate any managed device. - They can establish unauthorized reverse SSH tunnels and interact with devices without the owner's consent. This is a design flaw in the authentication model: compromise of a single key compromises the trust boundary between the controller and devices."
    },
    {
      "lang": "es",
      "value": "El controlador de nube AiKaan utiliza una única clave privada SSH codificada de forma rígida y el nombre de usuario ’proxyuser’ para el acceso remoto a la terminal de todos los dispositivos IoT/de borde gestionados. Cuando un administrador inicia ’Abrir Terminal Remota’ desde el panel de control de AiKaan, el controlador envía esta misma clave privada estática al dispositivo de destino. El dispositivo la utiliza entonces para establecer un túnel SSH inverso a un servidor de acceso remoto, lo que permite el acceso SSH basado en navegador para el administrador. Debido a que la misma cuenta ’proxyuser’ y clave SSH se reutilizan en todos los entornos de los clientes: - Un atacante que obtiene la clave (por ejemplo, interceptándola en tránsito, extrayéndola del servidor de acceso remoto, o de una cuenta de administrador comprometida) puede suplantar a cualquier dispositivo gestionado. - Pueden establecer túneles SSH inversos no autorizados e interactuar con los dispositivos sin el consentimiento del propietario. Esto es un fallo de diseño en el modelo de autenticación: el compromiso de una única clave compromete el límite de confianza entre el controlador y los dispositivos."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-23T16:06:24.963818Z",
          "id": "CVE-2025-57601",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/Shubhangborkar/aikaan-vulnerabilities/blob/main/cve1-shared-ssh-key.md",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Shubhangborkar/aikaan-vulnerabilities/blob/main/cve1-shared-ssh-key.md",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}