CVE-2025-2079 Overview
CVE-2025-2079 affects the Optigo Networks Visual BACnet Capture Tool and the Optigo Visual Networks Capture Tool version 3.1.2rc11. The products contain a hard coded secret key used for JSON Web Token (JWT) signing. An attacker who knows the key can forge valid JWT sessions and impersonate authenticated users. The flaw is categorized under CWE-547: Use of Hard-coded, Security-relevant Constants and impacts industrial control system environments where these capture tools assist with BACnet network analysis. CISA published advisory ICSA-25-070-02 to alert operators of building automation and operational technology networks.
Critical Impact
Attackers can forge valid JWT sessions remotely without authentication, gaining access to the capture tool's protected functions over the network.
Affected Products
- Optigo Networks Visual BACnet Capture Tool version 3.1.2rc11
- Optigo Visual Networks Capture Tool version 3.1.2rc11
- Deployments referenced in CISA ICS Advisory ICSA-25-070-02
Discovery Timeline
- 2025-03-13 - CVE-2025-2079 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-2079
Vulnerability Analysis
The Optigo Networks capture tools embed a static secret key inside the application binary. The tools use this key to sign and validate JWTs issued during user authentication. Because the key is identical across all installations of version 3.1.2rc11, anyone who extracts it from one instance can sign tokens accepted by every other instance. The vulnerability requires no prior authentication, no user interaction, and is reachable over the network according to the CVSS v4.0 vector. Confidentiality of the affected system is directly impacted because forged tokens grant access to authenticated sessions and the data they expose. The Exploit Prediction Scoring System (EPSS) probability is 0.196% with a percentile of 41.229 as of 2026-05-18.
Root Cause
The root cause is the inclusion of a hard-coded secret key in the application code rather than generating a unique signing key per installation. JWT validation depends entirely on the secrecy of the signing key. When that key is static and distributed with the software, it is recoverable through binary analysis or string inspection. This pattern is the defining example of CWE-547.
Attack Vector
An attacker first obtains the static key by examining a copy of the affected software. The attacker then crafts a JWT containing a chosen user identity and signs it with the recovered key. Submitting the forged token to a deployed capture tool produces a valid authenticated session. No credentials, network position, or social engineering are required beyond network reachability to the tool's web interface. See the CISA ICS Advisory ICSA-25-070-02 for vendor coordination details.
No public proof-of-concept code is referenced in the advisory data, so no exploitation code is reproduced here.
Detection Methods for CVE-2025-2079
Indicators of Compromise
- Authenticated sessions on the capture tool that do not correspond to a recorded login event in application logs
- JWTs presented to the tool with subject, issuer, or expiry values inconsistent with locally issued tokens
- Access from source IP addresses outside the expected operations or engineering subnets
Detection Strategies
- Inspect web server logs for Authorization: Bearer headers tied to requests without preceding /login activity
- Compare JWT iat and exp claims against application audit records to surface tokens issued outside the application's own clock
- Alert on access to administrative endpoints of the capture tool from unexpected hosts or at unusual hours
Monitoring Recommendations
- Forward capture tool web access logs and authentication events to a centralized log platform for correlation
- Baseline normal user, source IP, and session duration patterns, and alert on deviations
- Monitor north-south traffic to OT management VLANs hosting the Optigo tools for unexpected HTTPS clients
How to Mitigate CVE-2025-2079
Immediate Actions Required
- Restrict network access to the capture tool to a dedicated management VLAN and known engineering workstations
- Place the tool behind a VPN or jump host that enforces additional authentication
- Review existing sessions and force logout of all users until the system is updated
Patch Information
Refer to the CISA ICS Advisory ICSA-25-070-02 for the current vendor guidance from Optigo Networks. Operators should obtain the fixed build directly from the vendor and validate that the deployed version is no longer 3.1.2rc11.
Workarounds
- Block external access to the capture tool's HTTPS interface using firewall rules until a patched version is deployed
- Require client certificate authentication or network-layer authentication in front of the tool where supported
- Rotate any credentials or API tokens that may have been exposed through forged sessions
# Example firewall restriction limiting access to an engineering subnet
iptables -A INPUT -p tcp --dport 443 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
