The vulnerability arises when the web interface uses the default self‑signed SSL certificate to sign JSON Web Tokens. Because the certificate is predictable, an attacker can generate tokens that appear authentic and gain administrative privileges. The flaw does not expose device credentials or customer data, but it does allow configuration changes, log collection, and other privileged actions. CWE‑321 describes the weakness of using weak or guessable cryptographic credentials, which this case exemplifies.

Hitachi Vantara Remote Ops Agent, any release that relies on the default self‑signed certificate, up to but excluding version 2.1. The issue is resolved in Remote Ops Agent 2.1.

The flaw carries a CVSS score of 9.1 and is not currently listed in CISA KEV. EPSS information is unavailable, but the high criticality and remote nature of the exploitation suggest a significant risk. An attacker can exploit the flaw remotely through the web interface by crafting a JWT signed with the predictable certificate, thereby bypassing authentication and gaining full administrative control.