CVE-2025-41731 Jumo: Insufficient entropy in PRNG may lead to root access
An attacker can brute force the debug interface password due to weak PRNG entropy to gain root access on Jumo variTRON devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-41731?
CVE-2025-41731 is a high-severity vulnerability in Jumo variTRON300, published on 10 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was identified in the password generation algorithm when accessing the debug-interface. An unauthenticated local attacker with knowledge of the password generation timeframe might be able to brute force the password in a timely manner and thus gain root access to the device if the debug interface is still enabled.
Weakness: CWE-338
Which versions are affected by CVE-2025-41731?
How do I fix CVE-2025-41731?
No fix has been published for CVE-2025-41731 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-41731 being exploited?
There is no known exploitation of CVE-2025-41731 in the wild and no public exploit code.
Sources
Also known as GHSA-cgg5-w2f8-858m.