Skip to content
OpenAdvisories
Critical · 9.8 CVE-2025-41702 EUVD-2025-25832GHSA-6498-6rj5-p7pf

egOS WebGUI Hard-Coded JWT Secret Enables Authentication Bypass

Published Aug 26, 2025 · Updated Aug 26, 2025 · Assigned by CERTVDE

Vendor: Welotec Product: EG400Mk2-D11001-000101 Product: EG400Mk2-D11101-000101 Product: EG500Mk2-A11001-000101 Product: EG500Mk2-A11001-000201 Product: EG500Mk2-A11101-000101 Product: EG500Mk2-A12011-000101 Product: EG500Mk2-A21101-000101 Product: EG500Mk2-B11001-000101 Product: EG500Mk2-B11101-000101 Product: EG500Mk2-C11001-000101 Product: EG500Mk2-C11101-000101 Product: EG503L Product: EG503L_4GB Product: EG503L-G Product: EG503W Product: EG503W_4GB Product: EG602L Product: EG602W Product: EG603L Mk2 Product: EG603W Mk2 Product: EG802W Product: EG802W_i7_512GB_DinRail Product: EG802W_i7_512GB_w/o DinRail Product: EG804W Product: EG804W Pro

Description

The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key.

Affected products

VendorProductAffectedFixed
Welotec EG400Mk2-D11001-000101 0.0.0 – < v1.7.7, v1.8.0 – < v1.8.2 v1.7.7
Welotec EG400Mk2-D11101-000101 0.0.0 – < v1.7.7, v1.8.0 – < v1.8.2 v1.7.7
Welotec EG503W 0.0.0 – < v1.7.7, v1.8.0 – < v1.8.2 v1.7.7
Welotec EG503L 0.0.0 – < v1.7.7, v1.8.0 – < v1.8.2 v1.7.7
Welotec EG503W_4GB 0.0.0 – < v1.7.7, v1.8.0 – < v1.8.2 v1.7.7
Welotec EG503L_4GB 0.0.0 – < v1.7.7, v1.8.0 – < v1.8.2 v1.7.7
Welotec EG503L-G 0.0.0 – < v1.7.7, v1.8.0 – < v1.8.2 v1.7.7
Welotec EG500Mk2-A11101-000101 0.0.0 – < v1.7.7, v1.8.0 – < v1.8.2 v1.7.7
Welotec EG500Mk2-A11001-000101 0.0.0 – < v1.7.7, v1.8.0 – < v1.8.2 v1.7.7
Welotec EG500Mk2-B11101-000101 0.0.0 – < <v1.7.7, v1.8.0 – < v1.8.2 <v1.7.7
Welotec EG500Mk2-B11001-000101 0.0.0 – < <v1.7.7, v1.8.0 – < v1.8.2 <v1.7.7
Welotec EG500Mk2-C11101-000101 0.0.0 – < <v1.7.7, v1.8.0 – < v1.8.2 <v1.7.7
Welotec EG500Mk2-C11001-000101 0.0.0 – < <v1.7.7, v1.8.0 – < v1.8.2 <v1.7.7
Welotec EG500Mk2-A12011-000101 0.0.0 – < <v1.7.7, v1.8.0 – < v1.8.2 <v1.7.7
Welotec EG500Mk2-A11001-000201 0.0.0 – < <v1.7.7, v1.8.0 – < v1.8.2 <v1.7.7
Welotec EG500Mk2-A21101-000101 0.0.0 – < <v1.7.7, v1.8.0 – < v1.8.2 <v1.7.7
Welotec EG602W 0.0.0 – < <v1.7.7, v1.8.0 – < v1.8.2 <v1.7.7
Welotec EG602L 0.0.0 – < <v1.7.7, v1.8.0 – < v1.8.2 <v1.7.7
Welotec EG603W Mk2 0.0.0 – < <v1.7.7, v1.8.0 – < v1.8.2 <v1.7.7
Welotec EG603L Mk2 0.0.0 – < <v1.7.7, v1.8.0 – < v1.8.2 <v1.7.7
Welotec EG802W 0.0.0 – < <v1.7.7, v1.8.0 – < v1.8.2 <v1.7.7
Welotec EG804W 0.0.0 – < <v1.7.7, v1.8.0 – < v1.8.2 <v1.7.7
Welotec EG802W_i7_512GB_DinRail 0.0.0 – < <v1.7.7, v1.8.0 – < v1.8.2 <v1.7.7
Welotec EG802W_i7_512GB_w/o DinRail 0.0.0 – < <v1.7.7, v1.8.0 – < v1.8.2 <v1.7.7
Welotec EG804W Pro 0.0.0 – < <v1.7.7, v1.8.0 – < v1.8.2 <v1.7.7

Advisories 1

References