Description
A vulnerability was identified in the password generation algorithm when accessing the debug-interface. An unauthenticated local attacker with knowledge of the password generation timeframe might be able to brute force the password in a timely manner and thus gain root access to the device if the debug interface is still enabled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jumo | variTRON300 | 0.0.0.0 – < 9.0.2.5 | 9.0.2.5 |
| Jumo | variTRON500 | 0.0.0.0 – < 9.0.2.5 | 9.0.2.5 |
| Jumo | variTRON500 touch | 0.0.0.0 – < 9.0.2.5 | 9.0.2.5 |
Advisories 1
- VDE-2025-086 Jumo: Predictable debug-interface password in variTRON series CERT@VDE · Nov 10, 2025