Riskcovery

CVE-2025-41731

Jumo: Insufficient entropy in PRNG may lead to root access

State
Published
Severity
7.4 High
Published
Nov 10, 2025
Updated
Nov 10, 2025
Reserved
Apr 16, 2025

Read the record on cve.org

Description

A vulnerability was identified in the password generation algorithm when accessing the debug-interface. An unauthenticated local attacker with knowledge of the password generation timeframe might be able to brute force the password in a timely manner and thus gain root access to the device if the debug interface is still enabled.

Scores

CVSSScoreVectorSource
3.17.4 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCERTVDE

Weaknesses

  • CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Affected Products

ProductVersions
variTRON300Jumo
  • 0.0.0.0 to before 9.0.2.5Affected
variTRON500Jumo
  • 0.0.0.0 to before 9.0.2.5Affected
variTRON500 touchJumo
  • 0.0.0.0 to before 9.0.2.5Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.