by Kastro
Paper/Archive/CVE-2025-41702

CVE-2025-41702

Welotec EG400Mk2-D11001-000101 — egOS WebGUI Hard-Coded JWT Secret Enables Authentication Bypass

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 44.3.443 × 208.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key.

Affected

ProductAffectedFixed inSource
EG400Mk2-D11001-0001010.0.0 – < v1.7.7v1.7.7CNA
EG400Mk2-D11001-000101v1.8.0 – < v1.8.2v1.8.2CNA
EG400Mk2-D11101-0001010.0.0 – < v1.7.7v1.7.7CNA
EG400Mk2-D11101-000101v1.8.0 – < v1.8.2v1.8.2CNA
EG503W0.0.0 – < v1.7.7v1.7.7CNA
EG503Wv1.8.0 – < v1.8.2v1.8.2CNA
EG503L0.0.0 – < v1.7.7v1.7.7CNA
EG503Lv1.8.0 – < v1.8.2v1.8.2CNA
EG503W_4GB0.0.0 – < v1.7.7v1.7.7CNA
EG503W_4GBv1.8.0 – < v1.8.2v1.8.2CNA
EG503L_4GB0.0.0 – < v1.7.7v1.7.7CNA
EG503L_4GBv1.8.0 – < v1.8.2v1.8.2CNA

Scores by source

CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcertvde.com/de/advisories/VDE-2025-076