CVE-2025-10542 Insecure Default Admin Credentials Enable Full Administrative Access in iMonitor EAM
Remote attackers can use default admin credentials to access iMonitor EAM, read sensitive telemetry, and control monitored agents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-10542?
CVE-2025-10542 is a critical vulnerability in iMonitor EAM, published on 25 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
iMonitor EAM 9.6394 ships with default administrative credentials that are also displayed within the management client’s connection dialog. If the administrator does not change these defaults, a remote attacker can authenticate to the EAM server and gain full control over monitored agents and data. This enables reading highly sensitive telemetry (including keylogger output) and issuing arbitrary actions to all connected clients.
Weakness: CWE-1392
Which versions are affected by CVE-2025-10542?
How do I fix CVE-2025-10542?
No fix has been published for CVE-2025-10542 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-10542 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-10542 exists.
Sources
Also known as GHSA-35hw-x784-33fr.