HIJACKING OF THE TOKEN AND GAINING ACCESS

The

equipment grants a JWT token for each connection in the timeline, but during an

active valid session, a hijacking of the token can be done. This will allow an

attacker with the token modify parameters of security, access or even steal the

session without

the legitimate and active session detecting it. The web server allows the

attacker to reuse an old session JWT token while the legitimate session is

active.