Remote Access Vulnerability in iMonitor EAM by iMonitor Technologies
CVE-2025-10542

9.8CRITICAL

Key Information:

Vendor: Imonitor Software Inc.
Status: Imonitor Eam
Vendor: CVE Published:; 25 September 2025

🔔 Create Imonitor Software Inc. Vulnerability Alert

What is CVE-2025-10542?

The iMonitor EAM 9.6394 features default administrative credentials that are visible in the management client’s connection dialog. If not altered, these credentials enable remote attackers to gain unauthorized access to the EAM server. This breach may allow access to sensitive telemetry data, including keystrokes recorded by keyloggers, and facilitate execution of arbitrary commands on connected clients.

Affected Version(s)

iMonitor EAM 9.63.94

References

https://r.sec-consult.com/imonitor

third-party-advisory

CVSS V3.1

Score:

9.8

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 25, 2025
Vulnerability Reserved
Sep 16, 2025

Credit

Marius Renner, SEC Consult Vulnerability Lab

Daniel Hirschberger, SEC Consult Vulnerability Lab

Tobias Niemann, SEC Consult Vulnerability Lab

Thorger Jansen, SEC Consult Vulnerability Lab

JSON