CVE-2025-41702
BaseFortify
Publication date: 2025-08-26
Last updated on: 2025-08-26
Assigner: CERT VDE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| welotec | egos | 1.8.2 |
| welotec | egos | * |
| welotec | egos | 1.8.0 |
| welotec | egos | 1.8.1 |
| welotec | egos | 1.7.6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-321 | The product uses a hard-coded, unchangeable cryptographic key. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs because the JWT secret key is hard-coded and embedded in the egOS WebGUI backend, making it readable to the default user. As a result, an unauthenticated remote attacker can obtain this secret key and generate valid HS256 tokens, allowing them to bypass authentication and authorization mechanisms.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can gain unauthorized access to the system by creating valid authentication tokens without needing valid credentials. This can lead to full compromise of confidentiality, integrity, and availability of the affected system.