ESPEC North America Web Controller JWT Secret Exposure Vulnerability

A vulnerability exists in ESPEC North America Web Controller versions 3.0.0 prior to 3.3.4. When an invalid authentication request is made to the API, the response inadvertently includes the JWT secret. This exposure can be exploited to gain elevated permissions in the user interface by allowing the generation of valid JWTs without server involvement.

Impact

Exploitation of this vulnerability allows for unauthorized elevation of privileges within the application, potentially leading to unauthorized access or actions in the user interface.

Remediation

Users are advised to update the Web Controller firmware to version 3.3.4 or newer. After updating, all previously generated JWT tokens will be invalidated, requiring users to re-authenticate.