Skip to content
OpenAdvisories
Critical VDE-2025-076 1 CVE

Welotec: Hard-coded JWT secret in egOS WebGUI

Published Aug 26, 2025 · Updated Aug 26, 2025

Vendor: Welotec Product: EG400Mk2-D11001-000101 Product: EG400Mk2-D11101-000101 Product: EG500Mk2-A11001-000101 Product: EG500Mk2-A11001-000201 Product: EG500Mk2-A11101-000101 Product: EG500Mk2-A12011-000101 Product: EG500Mk2-A21101-000101 Product: EG500Mk2-B11001-000101 Product: EG500Mk2-B11101-000101 Product: EG500Mk2-C11001-000101 Product: EG500Mk2-C11101-000101 Product: EG503L Product: EG503L_4GB Product: EG503L-G Product: EG503W Product: EG503W_4GB Product: EG602L Product: EG602W Product: EG603L Mk2 Product: EG603W Mk2 Product: EG802W Product: EG802W_i7_512GB_DinRail Product: EG802W_i7_512GB_w/o DinRail Product: EG804W Product: EG804W Pro

Summary

A hard-coded JWT secret in the egOS WebGUI backend is readable to the default user, allowing attackers to forge valid tokens and access protected API endpoints.

Vulnerabilities 1

  • Critical 9.8
    CVE-2025-41702

    egOS WebGUI Hard-Coded JWT Secret Enables Authentication Bypass

    The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key.

    Welotec EG500Mk2-A12011-000101 EG503L-G EG802W_i7_512GB_DinRail

Revision history

  1. #1.0.0

    initial version

References