Executive brief
A critical vulnerability in the iMonnit cloud platform allows unauthorized individuals to take over any user account. By exploiting a flaw in the password reset process, an attacker can change the password of any account without needing the owner's permission or interaction. This could lead to full access to sensitive sensor data, device configurations, and monitoring dashboards for industrial and commercial IoT systems.
Technical details
A critical authentication bypass vulnerability (CWE-640) exists in the iMonnit cloud platform (*.imonnit.com) due to a failure to validate the association between a password reset token and the target account. An attacker can request a password reset for their own account to obtain a valid token, then submit a crafted POST request to the /Account/PasswordReset/ endpoint using that token while specifying a victim's email address and username. Because the backend does not verify that the token belongs to the provided email, it accepts the request and resets the victim's password. This allows for remote, unauthenticated account takeover of any user on the platform without victim interaction.
Affected products
- Monnit Corporation iMonnit Cloud Platform All versions as of 2025-04-24
Timeline
- 2025-04-24: disclosed: Vulnerability discovered/reported in imonnit.com
- 2025-11-26: advisory: CVE published to NVD