CVE-2025-41702 json
egOS WebGUI Hard-Coded JWT Secret Enables Authentication Bypass
published 2025-08-26 14 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-25832
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 44%
- public exploits
- 0
- none known
Summary
The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key.
Patch / fix
- Welotec EG400Mk2-D11001-000101 v1.7.7, v1.8.2
- Welotec EG400Mk2-D11101-000101 v1.7.7, v1.8.2
- Welotec EG503W v1.7.7, v1.8.2
- Welotec EG503L v1.7.7, v1.8.2
- Welotec EG503W_4GB v1.7.7, v1.8.2
- Welotec EG503L_4GB v1.7.7, v1.8.2
- Welotec EG503L-G v1.7.7, v1.8.2
- Welotec EG500Mk2-A11101-000101 v1.7.7, v1.8.2
- Welotec EG500Mk2-A11001-000101 v1.7.7, v1.8.2
- Welotec EG500Mk2-B11101-000101 <v1.7.7, v1.8.2
- Welotec EG500Mk2-B11001-000101 <v1.7.7, v1.8.2
- Welotec EG500Mk2-C11101-000101 <v1.7.7, v1.8.2
- Welotec EG500Mk2-C11001-000101 <v1.7.7, v1.8.2
- Welotec EG500Mk2-A12011-000101 <v1.7.7, v1.8.2
- Welotec EG500Mk2-A11001-000201 <v1.7.7, v1.8.2
- Welotec EG500Mk2-A21101-000101 <v1.7.7, v1.8.2
- Welotec EG602W <v1.7.7, v1.8.2
- Welotec EG602L <v1.7.7, v1.8.2
- Welotec EG603W Mk2 <v1.7.7, v1.8.2
- Welotec EG603L Mk2 <v1.7.7, v1.8.2
- Welotec EG802W <v1.7.7, v1.8.2
- Welotec EG804W <v1.7.7, v1.8.2
- Welotec EG802W_i7_512GB_DinRail <v1.7.7, v1.8.2
- Welotec EG802W_i7_512GB_w/o DinRail <v1.7.7, v1.8.2
- Welotec EG804W Pro <v1.7.7, v1.8.2
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 14 mo ago
Exploit prediction
0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Welotec EG400Mk2-D11001-000101
- Welotec EG400Mk2-D11101-000101
- Welotec EG503W
- Welotec EG503L
- Welotec EG503W_4GB
- Welotec EG503L_4GB
- Welotec EG503L-G
- Welotec EG500Mk2-A11101-000101
- Welotec EG500Mk2-A11001-000101
- Welotec EG500Mk2-B11101-000101
- Welotec EG500Mk2-B11001-000101
- Welotec EG500Mk2-C11101-000101
- Welotec EG500Mk2-C11001-000101
- Welotec EG500Mk2-A12011-000101
- Welotec EG500Mk2-A11001-000201
- Welotec EG500Mk2-A21101-000101
- Welotec EG602W
- Welotec EG602L
- Welotec EG603W Mk2
- Welotec EG603L Mk2
- Welotec EG802W
- Welotec EG804W
- Welotec EG802W_i7_512GB_DinRail
- Welotec EG802W_i7_512GB_w/o DinRail
- Welotec EG804W Pro
Classification
- Weakness
-
- CWE-321 Use of Hard-coded Cryptographic Key
References
Sources
- CVE List CVE-2025-41702
- NVD CVE-2025-41702
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.