What is CVE-2025-52352?

CVE-2025-52352 is a critical-severity vulnerability in N/a, classified under Missing Authorization. CVSS score: 9.8/10. Published 2025-08-21.

How severe is CVE-2025-52352?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2025-52352 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in N/a

CVE-2025-52352

Aikaan IoT management platform v3.25.0325-5-g2e9c59796 provides a configuration to disable user sign-up in distributed deployments by hiding the sign-up option on the login page UI. However, the sign-up API endpoint remains publicly accessible and functional, allowing unauthenticated users to register accounts via APIs even when the feature is disabled. This leads to authentication bypass and unauthorized access to admin portals, violating intended access controls.

Vulnerability class: Broken Access Control

EPSS: 0.006 (43.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

N/a — versions n/a

Weakness classification (CWE)

CWE-862 — Missing Authorization

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

Frequently asked questions

What is CVE-2025-52352?: CVE-2025-52352 is a critical-severity vulnerability in N/a, classified under Missing Authorization. CVSS score: 9.8/10. Published 2025-08-21.
How severe is CVE-2025-52352?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2025-52352 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.