Overview
The Common Vulnerabilities and Exposures (CVE) system has recently exposed a new vulnerability, CVE-2025-52351, which poses a serious threat to users of the Aikaan IoT management platform. This vulnerability involves the practice of sending newly generated passwords to users in plaintext via email, and also including the same password as a query parameter in the account activation URL. As a result, the password can be exposed via browser history, proxy logs, referrer headers, and email caching. This vulnerability particularly affects user credential confidentiality during the initial onboarding process, and it is crucial for users to be aware of this risk and take appropriate measures to mitigate it.
Vulnerability Summary
CVE ID: CVE-2025-52351
Severity: High (CVSS: 8.8)
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Impact: Potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Aikaan IoT Management Platform | v3.25.0325-5-g2e9c59796
How the Exploit Works
The exploit takes advantage of the Aikaan IoT management platform’s password handling during the onboarding process. When a new user account is created, the platform generates a new password for the user and sends it to the user in plaintext via email. The same password is also included as a query parameter in the account activation URL. This means that the password is stored in the browser history, is visible in proxy logs, can be seen in referrer headers, and is cached in email servers. An attacker who has access to any of these resources can easily retrieve the password and compromise the user’s account.
Conceptual Example Code
Here is a conceptual example of the account activation URL that is sent to users:
GET /activate?username=johndoe&password=123456 HTTP/1.1
Host: aikaan-domain.comIn this example, the password “123456” is visible in the URL. Any system or person that has access to this URL can see the password in plaintext. This is the core of the vulnerability – the exposure of the password in a location where it can be easily intercepted or retrieved by an attacker.