ESPEC North America Web Controller Session Privilege Not Revoked on Logout Vulnerability

A vulnerability exists in ESPEC North America Web Controller versions 3.0.0 prior to 3.3.8, where session privileges are not properly revoked upon user logout. This issue allows JavaScript Web Tokens (JWT) to remain valid even after a user has logged out.

Impact

Exploitation of this vulnerability allows for session fixation, where a logged-out user's session token remains valid, potentially leading to unauthorized access.

Remediation

Users can update the Web Controller firmware to version 3.3.8 or newer to address this vulnerability. After updating, all tokens generated before the update will be invalidated, and users must re-login to the system.