https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 07:07:57 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-253312 EUVD-2026-253312 https://cve.radiocsirt.org/vuln/euvd-2026-253312 https://cve.radiocsirt.org/vuln/fkie_cve-2025-57601 <p>AiKaan Cloud Controller uses a single hardcoded SSH private key and the username `proxyuser` for remote terminal access to all managed IoT/edge devices. When an administrator initiates &#34;Open Remote Terminal&#34; from the AiKaan dashboard, the controller sends this same static private key to the target device. The device then uses it to establish a reverse SSH tunnel to a remote access server, enabling browser-based SSH access for the administrator. Because the same `proxyuser` account and SSH key are reused across all customer environments: - An attacker who obtains the key (e.g., by intercepting it in transit, extracting it from the remote access server, or from a compromised admin account) can impersonate any managed device. - They can establish unauthorized reverse SSH tunnels and interact with devices without the owner&#39;s consent. This is a design flaw in the authentication model: compromise of a single key compromises the trust boundary between the controller and devices.</p> <p>AiKaan Cloud Controller uses a single hardcoded SSH private key and the username `proxyuser` for remote terminal access to all managed IoT/edge devices. When an administrator initiates &#34;Open Remote Terminal&#34; from the AiKaan dashboard, the controller sends this same static private key to the target device. The device then uses it to establish a reverse SSH tunnel to a remote access server, enabling browser-based SSH access for the administrator. Because the same `proxyuser` account and SSH key are reused across all customer environments: - An attacker who obtains the key (e.g., by intercepting it in transit, extracting it from the remote access server, or from a compromised admin account) can impersonate any managed device. - They can establish unauthorized reverse SSH tunnels and interact with devices without the owner&#39;s consent. This is a design flaw in the authentication model: compromise of a single key compromises the trust boundary between the controller and devices.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-57601 https://cve.radiocsirt.org/vuln/ghsa-fj6f-975w-5xrx <p>AiKaan Cloud Controller uses a single hardcoded SSH private key and the username `proxyuser` for remote terminal access to all managed IoT/edge devices. When an administrator initiates &#34;Open Remote Terminal&#34; from the AiKaan dashboard, the controller sends this same static private key to the target device. The device then uses it to establish a reverse SSH tunnel to a remote access server, enabling browser-based SSH access for the administrator. Because the same `proxyuser` account and SSH key are reused across all customer environments: - An attacker who obtains the key (e.g., by intercepting it in transit, extracting it from the remote access server, or from a compromised admin account) can impersonate any managed device. - They can establish unauthorized reverse SSH tunnels and interact with devices without the owner&#39;s consent. This is a design flaw in the authentication model: compromise of a single key compromises the trust boundary between the controller and devices.</p> <p>AiKaan Cloud Controller uses a single hardcoded SSH private key and the username `proxyuser` for remote terminal access to all managed IoT/edge devices. When an administrator initiates &#34;Open Remote Terminal&#34; from the AiKaan dashboard, the controller sends this same static private key to the target device. The device then uses it to establish a reverse SSH tunnel to a remote access server, enabling browser-based SSH access for the administrator. Because the same `proxyuser` account and SSH key are reused across all customer environments: - An attacker who obtains the key (e.g., by intercepting it in transit, extracting it from the remote access server, or from a compromised admin account) can impersonate any managed device. - They can establish unauthorized reverse SSH tunnels and interact with devices without the owner&#39;s consent. This is a design flaw in the authentication model: compromise of a single key compromises the trust boundary between the controller and devices.</p> https://cve.radiocsirt.org/vuln/ghsa-fj6f-975w-5xrx