Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2025-41702

egOS WebGUI Hard-Coded JWT Secret Enables Authentication Bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERTVDE

Description

The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Welotec EG400Mk2-D11001-000101

Default version status: unaffected

  • 0.0.0 to < v1.7.7affected
  • v1.8.0 to < v1.8.2affected

Welotec EG400Mk2-D11101-000101

Default version status: unaffected

  • 0.0.0 to < v1.7.7affected
  • v1.8.0 to < v1.8.2affected

Welotec EG503W

Default version status: unaffected

  • 0.0.0 to < v1.7.7affected
  • v1.8.0 to < v1.8.2affected

Welotec EG503L

Default version status: unaffected

  • 0.0.0 to < v1.7.7affected
  • v1.8.0 to < v1.8.2affected

Welotec EG503W_4GB

Default version status: unaffected

  • 0.0.0 to < v1.7.7affected
  • v1.8.0 to < v1.8.2affected

Welotec EG503L_4GB

Default version status: unaffected

  • 0.0.0 to < v1.7.7affected
  • v1.8.0 to < v1.8.2affected

Welotec EG503L-G

Default version status: unaffected

  • 0.0.0 to < v1.7.7affected
  • v1.8.0 to < v1.8.2affected

Welotec EG500Mk2-A11101-000101

Default version status: unaffected

  • 0.0.0 to < v1.7.7affected
  • v1.8.0 to < v1.8.2affected

Welotec EG500Mk2-A11001-000101

Default version status: unaffected

  • 0.0.0 to < v1.7.7affected
  • v1.8.0 to < v1.8.2affected

Welotec EG500Mk2-B11101-000101

Default version status: unaffected

  • 0.0.0 to < <v1.7.7affected
  • v1.8.0 to < v1.8.2affected

Welotec EG500Mk2-B11001-000101

Default version status: unaffected

  • 0.0.0 to < <v1.7.7affected
  • v1.8.0 to < v1.8.2affected

Welotec EG500Mk2-C11101-000101

Default version status: unaffected

  • 0.0.0 to < <v1.7.7affected
  • v1.8.0 to < v1.8.2affected

Welotec EG500Mk2-C11001-000101

Default version status: unaffected

  • 0.0.0 to < <v1.7.7affected
  • v1.8.0 to < v1.8.2affected

Welotec EG500Mk2-A12011-000101

Default version status: unaffected

  • 0.0.0 to < <v1.7.7affected
  • v1.8.0 to < v1.8.2affected

Welotec EG500Mk2-A11001-000201

Default version status: unaffected

  • 0.0.0 to < <v1.7.7affected
  • v1.8.0 to < v1.8.2affected

Welotec EG500Mk2-A21101-000101

Default version status: unaffected

  • 0.0.0 to < <v1.7.7affected
  • v1.8.0 to < v1.8.2affected

Welotec EG602W

Default version status: unaffected

  • 0.0.0 to < <v1.7.7affected
  • v1.8.0 to < v1.8.2affected

Welotec EG602L

Default version status: unaffected

  • 0.0.0 to < <v1.7.7affected
  • v1.8.0 to < v1.8.2affected

Welotec EG603W Mk2

Default version status: unaffected

  • 0.0.0 to < <v1.7.7affected
  • v1.8.0 to < v1.8.2affected

Welotec EG603L Mk2

Default version status: unaffected

  • 0.0.0 to < <v1.7.7affected
  • v1.8.0 to < v1.8.2affected

Welotec EG802W

Default version status: unaffected

  • 0.0.0 to < <v1.7.7affected
  • v1.8.0 to < v1.8.2affected

Welotec EG804W

Default version status: unaffected

  • 0.0.0 to < <v1.7.7affected
  • v1.8.0 to < v1.8.2affected

Welotec EG802W_i7_512GB_DinRail

Default version status: unaffected

  • 0.0.0 to < <v1.7.7affected
  • v1.8.0 to < v1.8.2affected

Welotec EG802W_i7_512GB_w/o DinRail

Default version status: unaffected

  • 0.0.0 to < <v1.7.7affected
  • v1.8.0 to < v1.8.2affected

Welotec EG804W Pro

Default version status: unaffected

  • 0.0.0 to < <v1.7.7affected
  • v1.8.0 to < v1.8.2affected

References