egOS WebGUI Hard-Coded JWT Secret Enables Authentication Bypass
Priority MEDIUM 49CWE-321Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-321.
Summary
The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00522 44th percentileScored 2026-11-07
Fix Fixed EG400Mk2-D11001-000101 (Welotec): v1.7.7, v1.8.2EG400Mk2-D11101-000101 (Welotec): v1.7.7, v1.8.2+23 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Welotec | EG400Mk2-D11001-000101 | 0.0.0 to before v1.7.7; v1.8.0 to before v1.8.2 | v1.7.7, v1.8.2 | Patch available | CNA |
| Welotec | EG400Mk2-D11101-000101 | 0.0.0 to before v1.7.7; v1.8.0 to before v1.8.2 | v1.7.7, v1.8.2 | Patch available | CNA |
| Welotec | EG503W | 0.0.0 to before v1.7.7; v1.8.0 to before v1.8.2 | v1.7.7, v1.8.2 | Patch available | CNA |
| Welotec | EG503L | 0.0.0 to before v1.7.7; v1.8.0 to before v1.8.2 | v1.7.7, v1.8.2 | Patch available | CNA |
| Welotec | EG503W_4GB | 0.0.0 to before v1.7.7; v1.8.0 to before v1.8.2 | v1.7.7, v1.8.2 | Patch available | CNA |
| Welotec | EG503L_4GB | 0.0.0 to before v1.7.7; v1.8.0 to before v1.8.2 | v1.7.7, v1.8.2 | Patch available | CNA |
| Welotec | EG503L-G | 0.0.0 to before v1.7.7; v1.8.0 to before v1.8.2 | v1.7.7, v1.8.2 | Patch available | CNA |
| Welotec | EG500Mk2-A11101-000101 | 0.0.0 to before v1.7.7; v1.8.0 to before v1.8.2 | v1.7.7, v1.8.2 | Patch available | CNA |
| Welotec | EG500Mk2-A11001-000101 | 0.0.0 to before v1.7.7; v1.8.0 to before v1.8.2 | v1.7.7, v1.8.2 | Patch available | CNA |
| Welotec | EG500Mk2-B11101-000101 | 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 | <v1.7.7, v1.8.2 | Patch available | CNA |
| Welotec | EG500Mk2-B11001-000101 | 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 | <v1.7.7, v1.8.2 | Patch available | CNA |
| Welotec | EG500Mk2-C11101-000101 | 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 | <v1.7.7, v1.8.2 | Patch available | CNA |
| Welotec | EG500Mk2-C11001-000101 | 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 | <v1.7.7, v1.8.2 | Patch available | CNA |
| Welotec | EG500Mk2-A12011-000101 | 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 | <v1.7.7, v1.8.2 | Patch available | CNA |
| Welotec | EG500Mk2-A11001-000201 | 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 | <v1.7.7, v1.8.2 | Patch available | CNA |
| Welotec | EG500Mk2-A21101-000101 | 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 | <v1.7.7, v1.8.2 | Patch available | CNA |
| Welotec | EG602W | 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 | <v1.7.7, v1.8.2 | Patch available | CNA |
| Welotec | EG602L | 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 | <v1.7.7, v1.8.2 | Patch available | CNA |
| Welotec | EG603W Mk2 | 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 | <v1.7.7, v1.8.2 | Patch available | CNA |
| Welotec | EG603L Mk2 | 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 | <v1.7.7, v1.8.2 | Patch available | CNA |
| Welotec | EG802W | 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 | <v1.7.7, v1.8.2 | Patch available | CNA |
| Welotec | EG804W | 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 | <v1.7.7, v1.8.2 | Patch available | CNA |
| Welotec | EG802W_i7_512GB_DinRail | 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 | <v1.7.7, v1.8.2 | Patch available | CNA |
| Welotec | EG802W_i7_512GB_w/o DinRail | 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 | <v1.7.7, v1.8.2 | Patch available | CNA |
| Welotec | EG804W Pro | 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 | <v1.7.7, v1.8.2 | Patch available | CNA |
- EG400Mk2-D11001-000101 VendorWelotec Affected 0.0.0 to before v1.7.7; v1.8.0 to before v1.8.2 Fixed in v1.7.7, v1.8.2 Patch available CNA
- EG400Mk2-D11101-000101 VendorWelotec Affected 0.0.0 to before v1.7.7; v1.8.0 to before v1.8.2 Fixed in v1.7.7, v1.8.2 Patch available CNA
- EG503W VendorWelotec Affected 0.0.0 to before v1.7.7; v1.8.0 to before v1.8.2 Fixed in v1.7.7, v1.8.2 Patch available CNA
- EG503L VendorWelotec Affected 0.0.0 to before v1.7.7; v1.8.0 to before v1.8.2 Fixed in v1.7.7, v1.8.2 Patch available CNA
- EG503W_4GB VendorWelotec Affected 0.0.0 to before v1.7.7; v1.8.0 to before v1.8.2 Fixed in v1.7.7, v1.8.2 Patch available CNA
- EG503L_4GB VendorWelotec Affected 0.0.0 to before v1.7.7; v1.8.0 to before v1.8.2 Fixed in v1.7.7, v1.8.2 Patch available CNA
- EG503L-G VendorWelotec Affected 0.0.0 to before v1.7.7; v1.8.0 to before v1.8.2 Fixed in v1.7.7, v1.8.2 Patch available CNA
- EG500Mk2-A11101-000101 VendorWelotec Affected 0.0.0 to before v1.7.7; v1.8.0 to before v1.8.2 Fixed in v1.7.7, v1.8.2 Patch available CNA
- EG500Mk2-A11001-000101 VendorWelotec Affected 0.0.0 to before v1.7.7; v1.8.0 to before v1.8.2 Fixed in v1.7.7, v1.8.2 Patch available CNA
- EG500Mk2-B11101-000101 VendorWelotec Affected 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 Fixed in <v1.7.7, v1.8.2 Patch available CNA
- EG500Mk2-B11001-000101 VendorWelotec Affected 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 Fixed in <v1.7.7, v1.8.2 Patch available CNA
- EG500Mk2-C11101-000101 VendorWelotec Affected 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 Fixed in <v1.7.7, v1.8.2 Patch available CNA
- EG500Mk2-C11001-000101 VendorWelotec Affected 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 Fixed in <v1.7.7, v1.8.2 Patch available CNA
- EG500Mk2-A12011-000101 VendorWelotec Affected 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 Fixed in <v1.7.7, v1.8.2 Patch available CNA
- EG500Mk2-A11001-000201 VendorWelotec Affected 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 Fixed in <v1.7.7, v1.8.2 Patch available CNA
- EG500Mk2-A21101-000101 VendorWelotec Affected 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 Fixed in <v1.7.7, v1.8.2 Patch available CNA
- EG602W VendorWelotec Affected 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 Fixed in <v1.7.7, v1.8.2 Patch available CNA
- EG602L VendorWelotec Affected 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 Fixed in <v1.7.7, v1.8.2 Patch available CNA
- EG603W Mk2 VendorWelotec Affected 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 Fixed in <v1.7.7, v1.8.2 Patch available CNA
- EG603L Mk2 VendorWelotec Affected 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 Fixed in <v1.7.7, v1.8.2 Patch available CNA
- EG802W VendorWelotec Affected 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 Fixed in <v1.7.7, v1.8.2 Patch available CNA
- EG804W VendorWelotec Affected 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 Fixed in <v1.7.7, v1.8.2 Patch available CNA
- EG802W_i7_512GB_DinRail VendorWelotec Affected 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 Fixed in <v1.7.7, v1.8.2 Patch available CNA
- EG802W_i7_512GB_w/o DinRail VendorWelotec Affected 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 Fixed in <v1.7.7, v1.8.2 Patch available CNA
- EG804W Pro VendorWelotec Affected 0.0.0 to before <v1.7.7; v1.8.0 to before v1.8.2 Fixed in <v1.7.7, v1.8.2 Patch available CNA
Remediation
- Fix · CNA EG400Mk2-D11001-000101 (Welotec) Fixed in v1.7.7, v1.8.2
- Fix · CNA EG400Mk2-D11101-000101 (Welotec) Fixed in v1.7.7, v1.8.2
- Fix · CNA EG503W (Welotec) Fixed in v1.7.7, v1.8.2
- Fix · CNA EG503L (Welotec) Fixed in v1.7.7, v1.8.2
- Fix · CNA EG503W_4GB (Welotec) Fixed in v1.7.7, v1.8.2
- Fix · CNA EG503L_4GB (Welotec) Fixed in v1.7.7, v1.8.2
- Fix · CNA EG503L-G (Welotec) Fixed in v1.7.7, v1.8.2
- Fix · CNA EG500Mk2-A11101-000101 (Welotec) Fixed in v1.7.7, v1.8.2
- Fix · CNA EG500Mk2-A11001-000101 (Welotec) Fixed in v1.7.7, v1.8.2
- Fix · CNA EG500Mk2-B11101-000101 (Welotec) Fixed in <v1.7.7, v1.8.2
- Fix · CNA EG500Mk2-B11001-000101 (Welotec) Fixed in <v1.7.7, v1.8.2
- Fix · CNA EG500Mk2-C11101-000101 (Welotec) Fixed in <v1.7.7, v1.8.2
- Fix · CNA EG500Mk2-C11001-000101 (Welotec) Fixed in <v1.7.7, v1.8.2
- Fix · CNA EG500Mk2-A12011-000101 (Welotec) Fixed in <v1.7.7, v1.8.2
- Fix · CNA EG500Mk2-A11001-000201 (Welotec) Fixed in <v1.7.7, v1.8.2
- Fix · CNA EG500Mk2-A21101-000101 (Welotec) Fixed in <v1.7.7, v1.8.2
- Fix · CNA EG602W (Welotec) Fixed in <v1.7.7, v1.8.2
- Fix · CNA EG602L (Welotec) Fixed in <v1.7.7, v1.8.2
- Fix · CNA EG603W Mk2 (Welotec) Fixed in <v1.7.7, v1.8.2
- Fix · CNA EG603L Mk2 (Welotec) Fixed in <v1.7.7, v1.8.2
- Fix · CNA EG802W (Welotec) Fixed in <v1.7.7, v1.8.2
- Fix · CNA EG804W (Welotec) Fixed in <v1.7.7, v1.8.2
- Fix · CNA EG802W_i7_512GB_DinRail (Welotec) Fixed in <v1.7.7, v1.8.2
- Fix · CNA EG802W_i7_512GB_w/o DinRail (Welotec) Fixed in <v1.7.7, v1.8.2
- Fix · CNA EG804W Pro (Welotec) Fixed in <v1.7.7, v1.8.2
Timeline
- 2026-10-02 Threatist record created from CVE-2025-41702
- 2026-10-03 Alias added: GHSA-6498-6rj5-p7pf
References
More Welotec vulnerabilities
- TI-2023-01026 Welotec: improper access control in TK500v1 router series CVSS 3.1CRITICAL 9.8
- TI-2023-01025 Welotec: Command injection vulnerability in TK500v1 router series CVSS 3.1HIGH 8.8
- TI-2025-27677 Path Traversal via 'Upload-Key' in SmartEMS Upload Handling CVSS 3.1HIGH 8.8
- TI-2026-84181 Command injection in Welotec IPsec VPN CVSS 4.0HIGH 8.6
- TI-2026-84180 Command Injection in Welotec Digital I/O CVSS 4.0HIGH 8.6
- TI-2026-84179 Command injection in Welotec WireGuard VPN function CVSS 4.0HIGH 8.6
Sources
- CVE-2025-41702 · CVE Program
- CVE-2025-41702 · NVD
- FIRST EPSS
- GHSA-6498-6rj5-p7pf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences