Start with Identity
Subscribe
Identity CVE · OAuth / OIDC / JWT

CVE-2025-49151ICS JWT auth bypass via hard-coded constants

critical
Product: ICS product (CISA ICSA-25-175-07)Vendor: ICS vendor (see CISA advisory)CWE-547Disclosed: 2025-06-24Status: PatchedProtocol deep diveNVD ↗

What broke

An industrial product covered by CISA ICSA-25-175-07 verified JWTs against hard-coded constants (CWE-547) rather than a real key. Anyone who read the firmware or the advisory can mint a valid token. Critical. Vendor patched.

Why it matters

OT and ICS identity is often "we added JWT in the last firmware." Hard-coded secrets are how that upgrade fails. The same lesson as hard-coded credentials in enterprise SaaS, with a plant-floor blast radius.

What to do

  • Apply the firmware named in ICSA-25-175-07.
  • Rotate any identity secret that shipped in the image. A patch that leaves the old constant in place is not a fix.
  • For any ICS or appliance SSO, ask the vendor where the JWT signing key lives. If the answer is "in the firmware," do not federate it to your corporate IdP.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.