What’s Vulnerable › Vulnerabilities
CVE-2025-41731: Jumo: Insufficient entropy in PRNG may lead to root access
- Severity: high (CVSS 7.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-11-10 · updated 2026-10-18
- Weakness: CWE-338
Description
A vulnerability was identified in the password generation algorithm when accessing the debug-interface. An unauthenticated local attacker with knowledge of the password generation timeframe might be able to brute force the password in a timely manner and thus gain root access to the device if the debug interface is still enabled.
Affected products
- Jumo variTRON300: from 0.0.0.0 before 9.0.2.5 — fixed in 9.0.2.5
- Jumo variTRON500: from 0.0.0.0 before 9.0.2.5 — fixed in 9.0.2.5
- Jumo variTRON500 touch: from 0.0.0.0 before 9.0.2.5 — fixed in 9.0.2.5
How to fix
Upgrade to a fixed version: Jumo variTRON300 9.0.2.5; Jumo variTRON500 9.0.2.5; Jumo variTRON500 touch 9.0.2.5. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-41731 or the next vulnerability affects your stack