Insecure Default Admin Credentials Enable Full Administrative Access in iMonitor EAM
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
iMonitor EAM 9.6394 ships with default administrative credentials that are also displayed within the management client’s connection dialog. If the administrator does not change these defaults, a remote attacker can authenticate to the EAM server and gain full control over monitored agents and data. This enables reading highly sensitive telemetry (including keylogger output) and issuing arbitrary actions to all connected clients.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| iMonitor Software Inc. | iMonitor EAM | 9.63.94 | — | No fix listed | CNA |
- iMonitor EAM VendoriMonitor Software Inc. Affected 9.63.94 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-10542
- 2026-10-03 Alias added: GHSA-35hw-x784-33fr
References
Advisory 1
More iMonitor Software Inc. vulnerabilities
- TI-2025-09646 Local Privilege Escalation via Insecure Update Mechanism in iMonitor EAM CVSS 3.1HIGH 7.8
- TI-2025-09645 Unencrypted and Unauthenticated Communication Allows Data Exposure and Manipulation in iMonitor EAM CVSS 3.1MEDIUM 6.5
Sources
- CVE-2025-10542 · CVE Program
- CVE-2025-10542 · NVD
- FIRST EPSS
- GHSA-35hw-x784-33fr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences