CVE-2025-52352
Published: 21 August 2025
Summary
CVE-2025-52352 is a critical-severity Missing Authorization (CWE-862) vulnerability in Aikaan IoT (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 31.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SC-14 (Public Access Protections).
Deeper analysis
CVE-2025-52352 affects the Aikaan IoT management platform, specifically version v3.25.0325-5-g2e9c59796. The vulnerability stems from a misconfiguration in distributed deployments where administrators can disable user sign-up by hiding the sign-up option on the login page UI. However, the underlying sign-up API endpoint remains publicly accessible and functional, enabling unauthenticated users to register new accounts via direct API calls despite the UI-level disablement. This flaw, classified under CWE-862 (Missing Authorization), carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-08-21.
Remote attackers require no privileges or user interaction to exploit this issue over the network with low complexity. By sending crafted requests to the exposed sign-up API, unauthenticated adversaries can create arbitrary accounts, bypassing intended authentication controls. Successful exploitation grants unauthorized access to admin portals, potentially allowing full compromise of confidentiality, integrity, and availability of the IoT management platform.
Mitigation details are available in vendor and researcher advisories, including the Aikaan project site at https://www.aikaan.io and a dedicated disclosure at https://github.com/Shubhangborkar/aikaan-vulnerabilities/blob/main/cve4-signup-api-bypass.md. Security practitioners should consult these references for patching instructions, configuration hardening, or workarounds to restrict API access.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-25469
Vulnerability details
Aikaan IoT management platform v3.25.0325-5-g2e9c59796 provides a configuration to disable user sign-up in distributed deployments by hiding the sign-up option on the login page UI. However, the sign-up API endpoint remains publicly accessible and functional, allowing unauthenticated users to register…
more
accounts via APIs even when the feature is disabled. This leads to authentication bypass and unauthorized access to admin portals, violating intended access controls.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Exposed public sign-up API enables unauthenticated account creation on a public-facing IoT management platform, directly matching exploitation of public-facing applications for initial access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for logical access, directly preventing unauthenticated access to the sign-up API endpoint despite UI disablement.
Restricts unauthorized public access to system interfaces like the exposed sign-up API, ensuring only approved actions are permitted without authentication.
Manages account creation processes to require approvals and disable unauthorized provisioning, mitigating impacts of API-bypassed registrations.