Welotec: Hard-coded JWT secret in egOS WebGUI
view advisory published 2025-08-26
A hard-coded JWT secret in the egOS WebGUI backend is readable to the default user, allowing attackers to forge valid tokens and access protected API endpoints.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-41702US | —OT elevated | — | ||
The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authent… | ||||
02
references
External citations — patches, advisories, analysis.
03
remediations (2)
- Mitigation
Temporarily disable the WebGUI or restrict network access to the WebGUI to trusted admin stations.
- Fixed
Update egOS to version v1.7.7 or v1.8.2.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan