iMonitor EAM version 9.6394 includes default administrative credentials that are visible in the management client's connection dialog. If these credentials are not changed by the administrator, a remote attacker can authenticate to the EAM server. This unauthorized access allows the attacker to fully control monitored agents and access sensitive telemetry data, including keylogger outputs, as well as perform arbitrary actions on all connected clients.