CVE-2025-2079: CWE-547 Use of Hard-Coded, Security-Relevant Constants in Optigo Networks Visual BACnet Capture Tool

CVE-2025-2079 describes a vulnerability in Optigo Networks Visual BACnet Capture Tool version 3.1.2rc11 where a hard-coded secret key is embedded in the software. This security flaw allows an attacker to potentially generate valid JWT sessions, bypassing authentication controls. The vulnerability is classified under CWE-547 (Use of Hard-Coded, Security-Relevant Constants). The CVSS 4.0 base score is 8.7, indicating a high impact with network attack vector, low attack complexity, and no required privileges or user interaction. No vendor advisory or patch information is currently available.

An attacker who discovers the hard-coded secret key could generate valid JWT tokens, potentially gaining unauthorized access to the application or its services. This compromises the authentication mechanism, leading to a high risk of unauthorized access. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected version and monitor for updates from Optigo Networks. Avoid deploying version 3.1.2rc11 in sensitive environments if possible.