victor Web Client and C•CURE Web Client JSON Web Token (JWT) Vulnerability

7.1 CVSS

Vulnerability Description

A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on the network to create and sign their own JSON Web Token and use it to execute an HTTP API Method without the need for valid authentication/authorization. Under certain circumstances, this could be used by an attacker to impact system availability by conducting a Denial of Service attack.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-9049

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Joachim Kerschbaumer reported this vulnerability to Johnson Controls, Inc.

References

More from Johnson Controls

View All →

CVE-2025-61740

Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG Origin Validation Error

High 7.2

CVE-2025-61739

Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG reusing a nonce, key pair in encryption

High 7.2

CVE-2025-61738

Johnson Controls PowerG and IQPanel cleartext transmission of sensitive information

Low 2.3

CVE-2025-61736

iSTAR- Improper Validation of Certificate Expiration

High 7.1

CVE-2025-43876

iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - get8021xSettings

High 8.7

Affected Vendor

Johnson Controls

View all reports →

Affected Software

victor Web Client version 5.6 and prior, C•CURE Web Client version 2.90 and prior (Note - This does not affect the new web-based C•CURE 9000 client that was introduced in C•CURE 9000 v2.90)

Vulnerable Versions:

unspecified