Summary
The egOS system trust store uses certificate data from the Mozilla NSS root store. The trust store contains eMudhra emSign root certificates associated with eight compromised intermediate certificate authority keys. An unauthenticated attacker who possesses one of the compromised keys and can intercept relevant network traffic may issue fraudulent TLS certificates, impersonate remote services, and read or modify outgoing TLS traffic from the device.
Vulnerabilities 1
-
Medium 5.4
Cryptographic issue in the Security Block-lists, Allow-lists, and other State component
Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised c…
Revision history
-
#1.0.0
Initial release.
References
-
Welotec PSIRT
https://welotec.com/de/pages/coordinated-vulnerability-disclosure-policy
-
CERT@VDE Security Advisories for Welotec
https://certvde.com/de/advisories/vendor/welotec
-
VDE-2026-138: Welotec: Trust in Compromised Intermediate Certificates in egOS - HTML
https://certvde.com/en/advisories/VDE-2026-138