CVE-2025-10540
Unencrypted and Unauthenticated Communication Allows Data Exposure and Manipulation in iMonitor EAM
- State
- Published
- Severity
- 6.5 Medium
- Published
- Sep 25, 2025
- Updated
- Nov 3, 2025
- Reserved
- Sep 16, 2025
Description
iMonitor EAM 9.6394 transmits communication between the EAM client agent and the EAM server, as well as between the EAM monitor management software and the server, in plaintext without authentication or encryption. An attacker with network access can intercept sensitive information (such as credentials, keylogger data, and personally identifiable information) and tamper with traffic. This allows both unauthorized disclosure and modification of data, including issuing arbitrary commands to client agents.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | CISA-ADP |
Weaknesses
- CWE-319 Cleartext Transmission of Sensitive Information
Affected Products
| Product | Versions |
|---|---|
iMonitor EAMiMonitor Software Inc. |
|
References
- https://r.sec-consult.com/imonitorthird-party-advisory
- http://seclists.org/fulldisclosure/2025/Sep/72
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.