iMonitor EAM 9.6394 ships with default administrative credentials that are also displayed within the management client’s connection dialog.…
SEC-VLab·CWE-1392·Published 2025-09-25
iMonitor EAM 9.6394 ships with default administrative credentials that are also displayed within the management client’s connection dialog. If the administrator does not change these defaults, a remote attacker can authenticate to the EAM server and gain full control over monitored agents and data. This enables reading highly sensitive telemetry (including keylogger output) and issuing arbitrary actions to all connected clients.
iMonitor EAM 9.6394 ships with default administrative credentials that are also displayed within the management client’s connection dialog. If the administrator does not change these defaults, a remote attacker can authenticate to the EAM server and gain full control over monitored agents and data. This enables reading highly sensitive telemetry (including keylogger output) and issuing arbitrary actions to all connected clients.
iMonitor EAM 9.6394 se envía con credenciales administrativas predeterminadas que también se muestran dentro del diálogo de conexión del cliente de gestión. Si el administrador no cambia estos valores predeterminados, un atacante remoto puede autenticarse en el servidor EAM y obtener control total sobre los agentes y datos monitorizados. Esto permite la lectura de telemetría altamente sensible (incluyendo la salida del registrador de teclas) y la emisión de acciones arbitrarias a todos los clientes conectados.
| Version | Type | Source | Base | Exp | Impact | Vector |
|---|---|---|---|---|---|---|
| 3.1 | Primary | cve.org | 9.8 | — | — | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | Primary | cve.org | 9.8 | — | — | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | Secondary | NVD | 9.8 | 3.9 | 5.9 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |