https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T10:38:32.001761+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-41702 CVE-2025-41702 — egOS WebGUI Hard-Coded JWT Secret Enables Authentication Bypass 2026-10-02T10:38:32.017356+00:00

Affected: Welotec EG400Mk2-D11001-000101, Welotec EG400Mk2-D11101-000101, Welotec EG503W, Welotec EG503L, Welotec EG503W_4GB, Welotec EG503L_4GB, Welotec EG503L-G, Welotec EG500Mk2-A11101-000101, Welotec EG500Mk2-A11001-000101, Welotec EG500Mk2-B11101-000101 and 15 more

The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key.