The Aikaan IoT management platform suffers from a critical credential exposure vulnerability that allows unauthorized access to user accounts via intercepted activation links or email logs.

This vulnerability involves the transmission of plaintext passwords through insecure channels, specifically via email notifications and account activation URL query parameters. An attacker with low privileges, or one capable of monitoring network traffic or logs, can capture these credentials to compromise account confidentiality and integrity.

The exposure of user credentials in plaintext presents a significant risk to the confidentiality and integrity of the entire IoT management environment. Given the high CVSS score of 8.8, this flaw could allow unauthorized actors to gain administrative or user-level access, leading to potential data exfiltration, device hijacking, or further lateral movement within the network.

Immediate Action: Since no official patch is currently identified, administrators must disable new user account creation processes that rely on these insecure activation links and rotate credentials for any users onboarded through this method.

Proactive Monitoring: Security teams should audit proxy logs, browser history records, and mail server logs to identify instances where activation URLs containing sensitive parameters were logged or cached.

Compensating Controls: Deploy a Web Application Firewall to monitor and block requests containing sensitive information in URL query parameters, and enforce the use of secure, out-of-band password reset mechanisms rather than plaintext delivery.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the security researcher's repository linked in the official references.

This vulnerability represents a severe failure in secure credential handling practices. Organizations utilizing the affected version of the Aikaan IoT management platform must treat this as a high-priority risk and implement the suggested compensating controls immediately to protect against credential harvesting, pending further guidance or a security update from the vendor.