CVE-2026-108336: CWE-321 Use of hard-coded cryptographic key in Hitachi Vantara Remot Ops Agent

This vulnerability arises from the use of a hard-coded cryptographic key (default self-signed SSL certificate) in Hitachi Vantara Remot Ops Agent. The SSL certificate is used to sign JWT access tokens that validate user sessions. When the default certificate is used, an attacker can forge JWT tokens to bypass authentication and gain administrative privileges, allowing configuration changes and log collection requests. The vulnerability does not expose device credentials or customer data.

Exploitation allows an unauthenticated attacker to gain administrative access to the Remot Ops Agent application, enabling them to configure the service or request log collection. There is no impact on device credentials or customer data confidentiality. The CVSS 4.0 score is 9.1 (critical), indicating a high-severity remote attack with no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should avoid using the default self-signed SSL certificate and replace it with a unique, securely generated certificate to prevent token forgery. Monitor vendor communications for updates on an official fix.