CVE-2025-57601 Hardcoded credentials in n/a
Attackers can impersonate managed IoT devices and establish unauthorized SSH tunnels by exploiting a shared hardcoded SSH private key used by the cloud controller.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-57601?
CVE-2025-57601 is a critical vulnerability in n/a, published on 22 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AiKaan Cloud Controller uses a single hardcoded SSH private key and the username `proxyuser` for remote terminal access to all managed IoT/edge devices. When an administrator initiates "Open Remote Terminal" from the AiKaan dashboard, the controller sends this same static private key to the target device. The device then uses it to establish a reverse SSH tunnel to a remote access server, enabling browser-based SSH access for the administrator. Because the same `proxyuser` account and SSH key are reused across all customer environments: - An attacker who obtains the key (e.g., by intercepting it in transit, extracting it from the remote access server, or from a compromised admin account) can impersonate any managed device. - They can establish unauthorized reverse SSH tunnels and interact with devices without the owner's consent. This is a design flaw in the authentication model: compromise of a single key compromises the trust boundary between the controller and devices.
Weakness: CWE-798
Which versions are affected by CVE-2025-57601?
How do I fix CVE-2025-57601?
No fix has been published for CVE-2025-57601 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-57601 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-57601 exists.
Sources
Also known as GHSA-fj6f-975w-5xrx.