Summary
The egOS system trust store uses certificate data from the Mozilla NSS root store. The trust store contains eMudhra emSign root certificates associated with eight compromised intermediate certificate authority keys. An unauthenticated attacker who possesses one of the compromised keys and can intercept relevant network traffic may issue fraudulent TLS certificates, impersonate remote services, and read or modify outgoing TLS traffic from the device.
Impact
Affected Product(s)
| Model no. | Product name | Affected versions |
|---|---|---|
| EG400Mk2-D11001-000101, EG400Mk2-D11101-000101 | EG400 Mk2 | egOS <1.11.2 |
| EG503W, EG503L, EG503W_4GB, EG503L_4GB, EG503L-G | EG500 | egOS <1.11.2 |
| EG500Mk2-A11101-000101, EG500Mk2-A11001-000101, EG500Mk2-B11101-000101, EG500Mk2-B11001-000101, EG500Mk2-C11101-000101, EG500Mk2-C11001-000101, EG500Mk2-A12011-000101, EG500Mk2-A11001-000201, EG500Mk2-A21101-000101 | EG500 Mk2 | egOS <1.11.2 |
| EG602W, EG602L | EG600 | egOS <1.11.2 |
| EG603W Mk2, EG603L Mk2 | EG600 Mk2 | egOS <1.11.2 |
| EG802W, EG804W, EG802W_i7_512GB_DinRail, EG802W_i7_512GB_w/o DinRail, EG804W Pro | EG800 | egOS <1.11.2 |
Vulnerabilities
Expand / Collapse allMozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2.
Acknowledgments
Welotec GmbH thanks the following parties for their efforts:
- CERT@VDE for coordination (see https://certvde.com )
Revision History
| Version | Date | Summary |
|---|---|---|
| 1.0.0 | 11/11/2026 20:00 | Initial release. |