CVE-2025-2080: CWE-288 Authentication Bypass Using an Alternate Path or Channel in Optigo Networks Visual BACnet Capture Tool

Optigo Networks Visual BACnet Capture Tool version 3.1.2rc11 contains an exposed web management service vulnerability (CWE-288) that permits authentication bypass via an alternate path or channel. This allows an unauthenticated attacker to gain control over product utilities without needing privileges or user interaction. The vulnerability is publicly documented as CVE-2025-2080 with a CVSS 4.0 base score of 9.3, reflecting critical severity. No vendor advisory or patch information is currently provided, and the product is not a cloud service, so remediation depends on vendor updates or mitigations.

Successful exploitation of this vulnerability allows unauthenticated attackers to bypass authentication and gain control over management functions of the Visual BACnet Capture Tool. This could lead to unauthorized access and manipulation of utilities within the product, potentially compromising system confidentiality, integrity, and availability. The critical CVSS score reflects the high risk posed by this flaw.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently documented, users should monitor Optigo Networks communications for updates. Until a patch is available, restricting network access to the exposed web management service and employing network-level controls may reduce exposure.