Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool Hard-Coded Secret Key Vulnerability Allowing JWT Session Generation

A vulnerability exists in Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool, both in version 3.1.2rc11, due to a hard-coded secret key. This flaw could enable an attacker to generate valid JSON Web Token (JWT) sessions. Additionally, these tools have an exposed web management service that may allow authentication bypass, control over the products, or impersonation of the web application service to mislead clients.

Impact

Exploitation of this vulnerability could lead to unauthorized generation of JWT sessions, allowing for authentication bypass and potential control over the affected tools.

Remediation

Users are advised to upgrade to Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.3rc8.