egOS WebGUI Hard-Coded JWT Secret Enables Authentication Bypass
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in v1.7.7, v1.8.2, <v1.7.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: total
Summary
The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: total
- Record last updated
Affected versions
- Welotec EG400Mk2-D11001-000101
From 0.0.0 · fixed in v1.7.7; From v1.8.0 · fixed in v1.8.2
- Welotec EG400Mk2-D11101-000101
From 0.0.0 · fixed in v1.7.7; From v1.8.0 · fixed in v1.8.2
- Welotec EG503W
From 0.0.0 · fixed in v1.7.7; From v1.8.0 · fixed in v1.8.2
- Welotec EG503L
From 0.0.0 · fixed in v1.7.7; From v1.8.0 · fixed in v1.8.2
- Welotec EG503W_4GB
From 0.0.0 · fixed in v1.7.7; From v1.8.0 · fixed in v1.8.2
- Welotec EG503L_4GB
From 0.0.0 · fixed in v1.7.7; From v1.8.0 · fixed in v1.8.2
- Welotec EG503L-G
From 0.0.0 · fixed in v1.7.7; From v1.8.0 · fixed in v1.8.2
- Welotec EG500Mk2-A11101-000101
From 0.0.0 · fixed in v1.7.7; From v1.8.0 · fixed in v1.8.2
- Welotec EG500Mk2-A11001-000101
From 0.0.0 · fixed in v1.7.7; From v1.8.0 · fixed in v1.8.2
- Welotec EG500Mk2-B11101-000101
From 0.0.0 · fixed in <v1.7.7; From v1.8.0 · fixed in v1.8.2
- Welotec EG500Mk2-B11001-000101
From 0.0.0 · fixed in <v1.7.7; From v1.8.0 · fixed in v1.8.2
- Welotec EG500Mk2-C11101-000101
From 0.0.0 · fixed in <v1.7.7; From v1.8.0 · fixed in v1.8.2
- Welotec EG500Mk2-C11001-000101
From 0.0.0 · fixed in <v1.7.7; From v1.8.0 · fixed in v1.8.2
- Welotec EG500Mk2-A12011-000101
From 0.0.0 · fixed in <v1.7.7; From v1.8.0 · fixed in v1.8.2
- Welotec EG500Mk2-A11001-000201
From 0.0.0 · fixed in <v1.7.7; From v1.8.0 · fixed in v1.8.2
- Welotec EG500Mk2-A21101-000101
From 0.0.0 · fixed in <v1.7.7; From v1.8.0 · fixed in v1.8.2
- Welotec EG602W
From 0.0.0 · fixed in <v1.7.7; From v1.8.0 · fixed in v1.8.2
- Welotec EG602L
From 0.0.0 · fixed in <v1.7.7; From v1.8.0 · fixed in v1.8.2
- Welotec EG603W Mk2
From 0.0.0 · fixed in <v1.7.7; From v1.8.0 · fixed in v1.8.2
- Welotec EG603L Mk2
From 0.0.0 · fixed in <v1.7.7; From v1.8.0 · fixed in v1.8.2
- Welotec EG802W
From 0.0.0 · fixed in <v1.7.7; From v1.8.0 · fixed in v1.8.2
- Welotec EG804W
From 0.0.0 · fixed in <v1.7.7; From v1.8.0 · fixed in v1.8.2
- Welotec EG802W_i7_512GB_DinRail
From 0.0.0 · fixed in <v1.7.7; From v1.8.0 · fixed in v1.8.2
- Welotec EG802W_i7_512GB_w/o DinRail
From 0.0.0 · fixed in <v1.7.7; From v1.8.0 · fixed in v1.8.2
- Welotec EG804W Pro
From 0.0.0 · fixed in <v1.7.7; From v1.8.0 · fixed in v1.8.2