A critical vulnerability in Dolusoft Omaspot allows for the interception of sensitive data and subsequent privilege escalation due to cleartext transmission, threatening the integrity of the entire system.

The application transmits sensitive data in cleartext, which can be intercepted by an attacker to perform man-in-the-middle attacks or capture credentials, ultimately facilitating privilege escalation.

The exposure of sensitive credentials and data through cleartext transmission significantly lowers the bar for attackers to gain elevated privileges. With a CVSS score of 9.6, this flaw poses a critical threat, potentially resulting in unauthorized administrative access, massive data breaches, and a compromise of the overall security posture of the affected infrastructure.

Immediate Action: Update Omaspot to the latest version released on or after 12.09.2025 to enforce secure, encrypted transmission of sensitive data.

Proactive Monitoring: Monitor network traffic for unencrypted protocols and review access logs for signs of anomalous privilege escalation attempts.

Compensating Controls: Utilize a VPN or TLS-terminating reverse proxy to force encryption for all traffic handled by the application if immediate patching is delayed.

Public Exploit Available: Unknown

The risk posed by cleartext transmission is severe, as it facilitates credential theft and full system compromise. Organizations must update Omaspot immediately and ensure that all communication channels are secured to prevent unauthorized interception.