CyberSecBulletin
CVE-2025-41702NVD status: Deferred

EG400Mk2-D11001-000101: Use of Hard-coded Cryptographic Key

Published Updated By the CyberSecBulletin desk

CVE-2025-41702 is a critical-severity use of hard-coded cryptographic key vulnerability in EG400Mk2-D11001-000101 from Welotec, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions v1.7.7, v1.8.2 as the first without the flaw, so updating EG400Mk2-D11001-000101 to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.52% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update EG400Mk2-D11001-000101 to v1.7.7 or v1.8.2, whichever matches your release line, or a later version.
  2. Update EG400Mk2-D11101-000101 to v1.7.7 or v1.8.2, whichever matches your release line, or a later version.
  3. Update EG503W to v1.7.7 or v1.8.2, whichever matches your release line, or a later version.
  4. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
WelotecEG400Mk2-D11001-000101before v1.7.7; v1.8.0 up to, but not including, v1.8.2v1.7.7, v1.8.2
WelotecEG400Mk2-D11101-000101before v1.7.7; v1.8.0 up to, but not including, v1.8.2v1.7.7, v1.8.2
WelotecEG503Wbefore v1.7.7; v1.8.0 up to, but not including, v1.8.2v1.7.7, v1.8.2
WelotecEG503Lbefore v1.7.7; v1.8.0 up to, but not including, v1.8.2v1.7.7, v1.8.2
WelotecEG503W_4GBbefore v1.7.7; v1.8.0 up to, but not including, v1.8.2v1.7.7, v1.8.2
WelotecEG503L_4GBbefore v1.7.7; v1.8.0 up to, but not including, v1.8.2v1.7.7, v1.8.2
WelotecEG503L-Gbefore v1.7.7; v1.8.0 up to, but not including, v1.8.2v1.7.7, v1.8.2
WelotecEG500Mk2-A11101-000101before v1.7.7; v1.8.0 up to, but not including, v1.8.2v1.7.7, v1.8.2
WelotecEG500Mk2-A11001-000101before v1.7.7; v1.8.0 up to, but not including, v1.8.2v1.7.7, v1.8.2
WelotecEG500Mk2-B11101-000101before <v1.7.7; v1.8.0 up to, but not including, v1.8.2<v1.7.7, v1.8.2
WelotecEG500Mk2-B11001-000101before <v1.7.7; v1.8.0 up to, but not including, v1.8.2<v1.7.7, v1.8.2
WelotecEG500Mk2-C11101-000101before <v1.7.7; v1.8.0 up to, but not including, v1.8.2<v1.7.7, v1.8.2
WelotecEG500Mk2-C11001-000101before <v1.7.7; v1.8.0 up to, but not including, v1.8.2<v1.7.7, v1.8.2
WelotecEG500Mk2-A12011-000101before <v1.7.7; v1.8.0 up to, but not including, v1.8.2<v1.7.7, v1.8.2
WelotecEG500Mk2-A11001-000201before <v1.7.7; v1.8.0 up to, but not including, v1.8.2<v1.7.7, v1.8.2
WelotecEG500Mk2-A21101-000101before <v1.7.7; v1.8.0 up to, but not including, v1.8.2<v1.7.7, v1.8.2
WelotecEG602Wbefore <v1.7.7; v1.8.0 up to, but not including, v1.8.2<v1.7.7, v1.8.2
WelotecEG602Lbefore <v1.7.7; v1.8.0 up to, but not including, v1.8.2<v1.7.7, v1.8.2
WelotecEG603W Mk2before <v1.7.7; v1.8.0 up to, but not including, v1.8.2<v1.7.7, v1.8.2
WelotecEG603L Mk2before <v1.7.7; v1.8.0 up to, but not including, v1.8.2<v1.7.7, v1.8.2
WelotecEG802Wbefore <v1.7.7; v1.8.0 up to, but not including, v1.8.2<v1.7.7, v1.8.2
WelotecEG804Wbefore <v1.7.7; v1.8.0 up to, but not including, v1.8.2<v1.7.7, v1.8.2
WelotecEG802W_i7_512GB_DinRailbefore <v1.7.7; v1.8.0 up to, but not including, v1.8.2<v1.7.7, v1.8.2
WelotecEG802W_i7_512GB_w/o DinRailbefore <v1.7.7; v1.8.0 up to, but not including, v1.8.2<v1.7.7, v1.8.2
WelotecEG804W Probefore <v1.7.7; v1.8.0 up to, but not including, v1.8.2<v1.7.7, v1.8.2

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA (cert.vde.com).

Official description

The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use of Hard-coded Cryptographic Key

The product uses a hard-coded, unchangeable cryptographic key.

How developers prevent this class of flaw

  • Prevention schemes mirror that of hard-coded password storage.

More Use of Hard-coded Cryptographic Key vulnerabilities (CWE-321)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use of Hard-coded Cryptographic Key vulnerabilities

Spotted an error? Tell us.