CVE-2025-41702

egOS WebGUI Hard-Coded JWT Secret Enables Authentication Bypass

State: Published
Severity: 9.8 Critical
Published: Aug 26, 2025
Updated: Aug 26, 2025
Reserved: Apr 16, 2025

Description

The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CERTVDE

Weaknesses

CWE-321 Use of Hard-coded Cryptographic Key

Affected Products

Product	Versions
EG400Mk2-D11001-000101Welotec	0.0.0 to before v1.7.7Affected v1.8.0 to before v1.8.2Affected
EG400Mk2-D11101-000101Welotec	0.0.0 to before v1.7.7Affected v1.8.0 to before v1.8.2Affected
EG503WWelotec	0.0.0 to before v1.7.7Affected v1.8.0 to before v1.8.2Affected
EG503LWelotec	0.0.0 to before v1.7.7Affected v1.8.0 to before v1.8.2Affected
EG503W_4GBWelotec	0.0.0 to before v1.7.7Affected v1.8.0 to before v1.8.2Affected
EG503L_4GBWelotec	0.0.0 to before v1.7.7Affected v1.8.0 to before v1.8.2Affected
EG503L-GWelotec	0.0.0 to before v1.7.7Affected v1.8.0 to before v1.8.2Affected
EG500Mk2-A11101-000101Welotec	0.0.0 to before v1.7.7Affected v1.8.0 to before v1.8.2Affected
EG500Mk2-A11001-000101Welotec	0.0.0 to before v1.7.7Affected v1.8.0 to before v1.8.2Affected
EG500Mk2-B11101-000101Welotec	0.0.0 to before <v1.7.7Affected v1.8.0 to before v1.8.2Affected
EG500Mk2-B11001-000101Welotec	0.0.0 to before <v1.7.7Affected v1.8.0 to before v1.8.2Affected
EG500Mk2-C11101-000101Welotec	0.0.0 to before <v1.7.7Affected v1.8.0 to before v1.8.2Affected
EG500Mk2-C11001-000101Welotec	0.0.0 to before <v1.7.7Affected v1.8.0 to before v1.8.2Affected
EG500Mk2-A12011-000101Welotec	0.0.0 to before <v1.7.7Affected v1.8.0 to before v1.8.2Affected
EG500Mk2-A11001-000201Welotec	0.0.0 to before <v1.7.7Affected v1.8.0 to before v1.8.2Affected
EG500Mk2-A21101-000101Welotec	0.0.0 to before <v1.7.7Affected v1.8.0 to before v1.8.2Affected
EG602WWelotec	0.0.0 to before <v1.7.7Affected v1.8.0 to before v1.8.2Affected
EG602LWelotec	0.0.0 to before <v1.7.7Affected v1.8.0 to before v1.8.2Affected
EG603W Mk2Welotec	0.0.0 to before <v1.7.7Affected v1.8.0 to before v1.8.2Affected
EG603L Mk2Welotec	0.0.0 to before <v1.7.7Affected v1.8.0 to before v1.8.2Affected
EG802WWelotec	0.0.0 to before <v1.7.7Affected v1.8.0 to before v1.8.2Affected
EG804WWelotec	0.0.0 to before <v1.7.7Affected v1.8.0 to before v1.8.2Affected
EG802W_i7_512GB_DinRailWelotec	0.0.0 to before <v1.7.7Affected v1.8.0 to before v1.8.2Affected
EG802W_i7_512GB_w/o DinRailWelotec	0.0.0 to before <v1.7.7Affected v1.8.0 to before v1.8.2Affected
EG804W ProWelotec	0.0.0 to before <v1.7.7Affected v1.8.0 to before v1.8.2Affected

References

https://certvde.com/de/advisories/VDE-2025-076

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.