CVE-2025-41702: egOS WebGUI Hard-Coded JWT Secret Enables Authentication Bypass

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-26 · updated 2026-06-17
Weakness: CWE-321

Description

The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key.

Affected products

Welotec EG400Mk2-D11001-000101: before v1.7.7; from v1.8.0 before v1.8.2 — fixed in v1.7.7, v1.8.2
Welotec EG400Mk2-D11101-000101: before v1.7.7; from v1.8.0 before v1.8.2 — fixed in v1.7.7, v1.8.2
Welotec EG500Mk2-A11001-000101: before v1.7.7; from v1.8.0 before v1.8.2 — fixed in v1.7.7, v1.8.2
Welotec EG500Mk2-A11001-000201: before <v1.7.7; from v1.8.0 before v1.8.2 — fixed in <v1.7.7, v1.8.2
Welotec EG500Mk2-A11101-000101: before v1.7.7; from v1.8.0 before v1.8.2 — fixed in v1.7.7, v1.8.2
Welotec EG500Mk2-A12011-000101: before <v1.7.7; from v1.8.0 before v1.8.2 — fixed in <v1.7.7, v1.8.2
Welotec EG500Mk2-A21101-000101: before <v1.7.7; from v1.8.0 before v1.8.2 — fixed in <v1.7.7, v1.8.2
Welotec EG500Mk2-B11001-000101: before <v1.7.7; from v1.8.0 before v1.8.2 — fixed in <v1.7.7, v1.8.2
Welotec EG500Mk2-B11101-000101: before <v1.7.7; from v1.8.0 before v1.8.2 — fixed in <v1.7.7, v1.8.2
Welotec EG500Mk2-C11001-000101: before <v1.7.7; from v1.8.0 before v1.8.2 — fixed in <v1.7.7, v1.8.2
Welotec EG500Mk2-C11101-000101: before <v1.7.7; from v1.8.0 before v1.8.2 — fixed in <v1.7.7, v1.8.2
Welotec EG503L: before v1.7.7; from v1.8.0 before v1.8.2 — fixed in v1.7.7, v1.8.2
Welotec EG503L-G: before v1.7.7; from v1.8.0 before v1.8.2 — fixed in v1.7.7, v1.8.2
Welotec EG503L_4GB: before v1.7.7; from v1.8.0 before v1.8.2 — fixed in v1.7.7, v1.8.2
Welotec EG503W: before v1.7.7; from v1.8.0 before v1.8.2 — fixed in v1.7.7, v1.8.2
Welotec EG503W_4GB: before v1.7.7; from v1.8.0 before v1.8.2 — fixed in v1.7.7, v1.8.2
Welotec EG602L: before <v1.7.7; from v1.8.0 before v1.8.2 — fixed in <v1.7.7, v1.8.2
Welotec EG602W: before <v1.7.7; from v1.8.0 before v1.8.2 — fixed in <v1.7.7, v1.8.2
Welotec EG603L Mk2: before <v1.7.7; from v1.8.0 before v1.8.2 — fixed in <v1.7.7, v1.8.2
Welotec EG603W Mk2: before <v1.7.7; from v1.8.0 before v1.8.2 — fixed in <v1.7.7, v1.8.2
Welotec EG802W: before <v1.7.7; from v1.8.0 before v1.8.2 — fixed in <v1.7.7, v1.8.2
Welotec EG802W_i7_512GB_DinRail: before <v1.7.7; from v1.8.0 before v1.8.2 — fixed in <v1.7.7, v1.8.2
Welotec EG802W_i7_512GB_w/o DinRail: before <v1.7.7; from v1.8.0 before v1.8.2 — fixed in <v1.7.7, v1.8.2
Welotec EG804W: before <v1.7.7; from v1.8.0 before v1.8.2 — fixed in <v1.7.7, v1.8.2
Welotec EG804W Pro: before <v1.7.7; from v1.8.0 before v1.8.2 — fixed in <v1.7.7, v1.8.2

How to fix

Upgrade to a fixed version: Welotec EG400Mk2-D11001-000101 v1.7.7, v1.8.2; Welotec EG400Mk2-D11101-000101 v1.7.7, v1.8.2; Welotec EG500Mk2-A11001-000101 v1.7.7, v1.8.2; Welotec EG500Mk2-A11001-000201 <v1.7.7, v1.8.2; Welotec EG500Mk2-A11101-000101 v1.7.7, v1.8.2; Welotec EG500Mk2-A12011-000101 <v1.7.7, v1.8.2; Welotec EG500Mk2-A21101-000101 <v1.7.7, v1.8.2; Welotec EG500Mk2-B11001-000101 <v1.7.7, v1.8.2; Welotec EG500Mk2-B11101-000101 <v1.7.7, v1.8.2; Welotec EG500Mk2-C11001-000101 <v1.7.7, v1.8.2; Welotec EG500Mk2-C11101-000101 <v1.7.7, v1.8.2; Welotec EG503L v1.7.7, v1.8.2. Check the vendor advisory for mitigations.

References

https://certvde.com/de/advisories/VDE-2025-076

Get alerted when CVE-2025-41702 or the next vulnerability affects your stack