CVE-2025-41702 (CVSS 9.8): Critical Flaw in Welotec egOS Puts Industrial Systems at Risk

CVE-2025-41702 (CVSS 9.8) is a critical flaw in Welotec egOS that could let unauthenticated attackers seize full control of affected devices, the article notes. According to advisory, the JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user, allowing an unauthenticated remote attacker to generate valid HS256 tokens and bypass authentication/authorization.

Attackers can impersonate any user—including administrators—modify configurations, upload firmware, reboot devices, and access sensitive logs, a sequence described as giving adversaries control over critical functions and data. The vulnerability affects multiple egOS-powered Welotec devices, including the EG400Mk2, EG500Mk2, EG503L, EG503W, EG602, EG603 Mk2, EG802, and EG804 series, with standard and Pro versions impacted if running firmware prior to v1.7.7 or v1.8.2.

CERT@VDE recommends mitigating by temporarily disabling the WebGUI or restricting network access to trusted admin stations, while Welotec has released patched firmware v1.7.7 and v1.8.2 for affected devices. Administrators should update to one of these versions as soon as possible.