CVE-2025-41702

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-321

Affected software

No affected versions have been published.

Timeline

Published: Aug 26, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-417037.5An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command.CVE-2025-417045.3An unauthanticated remote attacker can perform a DoS of the Modbus service by sending a specific function and sub-function code without affe CVE-2025-417056.8An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend.CVE-2025-417065.3The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an ove CVE-2025-417075.3The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket messag CVE-2025-417087.4Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same networ CVE-2025-417099.8An unauthenticated remote attacker can perform a command injection via Modbus-TCP or Modbus-RTU to gain read and write access on the affecte CVE-2025-41716.4The WZ Followed Posts – Display what visitors are reading plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's CVE-2025-417106.5An unauthenticated remote attacker may use hardcodes credentials to get access to the previously activated FTP Server with limited read and CVE-2025-417115.3An unauthenticated remote attacker can use firmware images to extract password hashes and brute force plaintext passwords of accounts with l CVE-2025-417126.5An unauthenticated remote attacker who tricks a user to upload a manipulated HTML file can get access to sensitive information on the device CVE-2025-417136.5During a short time frame while the device is booting an unauthenticated remote attacker can send traffic to unauthorized networks due to th