{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale",
      "text": "Medium"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "The egOS system trust store uses certificate data from the Mozilla NSS root store. The trust store contains eMudhra emSign root certificates associated with eight compromised intermediate certificate authority keys. An unauthenticated attacker who possesses one of the compromised keys and can intercept relevant network traffic may issue fraudulent TLS certificates, impersonate remote services, and read or modify outgoing TLS traffic from the device.",
        "title": "Summary"
      },
      {
        "category": "details",
        "text": "Successful exploitation requires an attacker to possess a corresponding compromised intermediate CA key and obtain a man-in-the-middle position. The attacker may then impersonate services contacted by egOS and read or modify information exchanged over affected TLS connections.",
        "title": "Impact"
      },
      {
        "category": "details",
        "text": "There is no supported customer-performable workaround for removing the affected certificates from the devices. Until the fixed egOS version can be installed, restrict egOS communication to trusted networks and use network segmentation or a trusted VPN where operationally possible. Prevent untrusted parties from gaining a man-in-the-middle position on network paths used by the affected devices. Monitor affected devices and connected services for unexpected TLS endpoints, certificate changes, and anomalous network activity.",
        "title": "Mitigation"
      },
      {
        "category": "details",
        "text": "Update egOS on all affected products to version 1.11.2 or later. The fixed release removes the affected emSign certificates from the system trust store.\n\nThis update corrects only the trust store of the egOS host system. Docker containers may include and use their own CA certificate bundles. These bundles are not modified by the egOS update. Operators must assess deployed container images separately and update or rebuild them as necessary.",
        "title": "Remediation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@welotec.com",
      "name": "Welotec GmbH",
      "namespace": "https://welotec.com"
    },
    "references": [
      {
        "category": "external",
        "summary": "Welotec PSIRT",
        "url": "https://welotec.com/de/pages/coordinated-vulnerability-disclosure-policy"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for Welotec",
        "url": "https://certvde.com/de/advisories/vendor/welotec"
      },
      {
        "category": "self",
        "summary": "VDE-2026-138: Welotec: Trust in Compromised Intermediate Certificates in egOS - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2026-138"
      },
      {
        "category": "self",
        "summary": "VDE-2026-138: Welotec: Trust in Compromised Intermediate Certificates in egOS - CSAF",
        "url": "https://welotec.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-138.json"
      }
    ],
    "title": "Welotec: Trust in Compromised Intermediate Certificates in egOS",
    "tracking": {
      "aliases": [
        "VDE-2026-138"
      ],
      "current_release_date": "2026-11-11T19:00:00.000Z",
      "generator": {
        "date": "2026-11-11T18:30:13.715Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.6.16"
        }
      },
      "id": "VDE-2026-138",
      "initial_release_date": "2026-11-11T19:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-11-11T19:00:00.000Z",
          "number": "1.0.0",
          "summary": "Initial release."
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_name",
                    "name": "EG400 Mk2",
                    "product": {
                      "name": "EG400 Mk2",
                      "product_id": "CSAFPID-11001",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:h:welotec:eg400_mk2:*:*:*:*:*:*:*:*",
                        "model_numbers": [
                          "EG400Mk2-D11001-000101",
                          "EG400Mk2-D11101-000101"
                        ],
                        "skus": [
                          "WEG500100210",
                          "WEG500100580"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_name",
                    "name": "EG500",
                    "product": {
                      "name": "EG500",
                      "product_id": "CSAFPID-11002",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:h:welotec:eg500_mk1:*:*:*:*:*:*:*:*",
                        "model_numbers": [
                          "EG503W",
                          "EG503L",
                          "EG503W_4GB",
                          "EG503L_4GB",
                          "EG503L-G"
                        ],
                        "skus": [
                          "WEG500100010",
                          "WEG500100020",
                          "WEG500100030",
                          "WEG500100040",
                          "WEG500100130"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_name",
                    "name": "EG500 Mk2",
                    "product": {
                      "name": "EG500 Mk2",
                      "product_id": "CSAFPID-11003",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:h:welotec:eg500_mk2:*:*:*:*:*:*:*:*",
                        "model_numbers": [
                          "EG500Mk2-A11101-000101",
                          "EG500Mk2-A11001-000101",
                          "EG500Mk2-B11101-000101",
                          "EG500Mk2-B11001-000101",
                          "EG500Mk2-C11101-000101",
                          "EG500Mk2-C11001-000101",
                          "EG500Mk2-A12011-000101",
                          "EG500Mk2-A11001-000201",
                          "EG500Mk2-A21101-000101"
                        ],
                        "skus": [
                          "WEG500100160",
                          "WEG500100170",
                          "WEG500100180",
                          "WEG500100190",
                          "WEG500100260",
                          "WEG500100270",
                          "WEG500100280",
                          "WEG500100290",
                          "WEG500100650"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_name",
                    "name": "EG600",
                    "product": {
                      "name": "EG600",
                      "product_id": "CSAFPID-11004",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:h:welotec:eg600_mk1:*:*:*:*:*:*:*:*",
                        "model_numbers": [
                          "EG602W",
                          "EG602L"
                        ],
                        "skus": [
                          "WEG600100010",
                          "WEG600100020"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_name",
                    "name": "EG600 Mk2",
                    "product": {
                      "name": "EG600 Mk2",
                      "product_id": "CSAFPID-11005",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:h:welotec:eg600_mk2:*:*:*:*:*:*:*:*",
                        "model_numbers": [
                          "EG603W Mk2",
                          "EG603L Mk2"
                        ],
                        "skus": [
                          "WEG600100140",
                          "WEG600100150"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_name",
                    "name": "EG800",
                    "product": {
                      "name": "EG800",
                      "product_id": "CSAFPID-11006",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:h:welotec:eg800_mk1:*:*:*:*:*:*:*:*",
                        "model_numbers": [
                          "EG802W",
                          "EG804W",
                          "EG802W_i7_512GB_DinRail",
                          "EG802W_i7_512GB_w/o DinRail",
                          "EG804W Pro"
                        ],
                        "skus": [
                          "WEG800100010",
                          "WEG800100020",
                          "WEG800100040",
                          "WEG800100050",
                          "WEG800100090"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_family",
                "name": "Edge Gateways"
              }
            ],
            "category": "product_family",
            "name": "Hardware"
          },
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:semver/>=0.0.0|<1.11.2",
                    "product": {
                      "name": "egOS <1.11.2",
                      "product_id": "CSAFPID-21001",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:o:welotec:egos:*:*:*:*:*:*:*:*"
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "1.11.2",
                    "product": {
                      "name": "egOS 1.11.2",
                      "product_id": "CSAFPID-22001",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:o:welotec:egos:1.11.2:*:*:*:*:*:*:*"
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "egOS"
              }
            ],
            "category": "product_family",
            "name": "Firmware"
          }
        ],
        "category": "vendor",
        "name": "Welotec"
      }
    ],
    "product_groups": [
      {
        "group_id": "CSAFGID-0001",
        "product_ids": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006"
        ],
        "summary": "Affected products running egOS versions earlier than 1.11.2."
      },
      {
        "group_id": "CSAFGID-0002",
        "product_ids": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006"
        ],
        "summary": "Fixed products running egOS 1.11.2."
      }
    ],
    "relationships": [
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "egOS <1.11.2 installed on EG400 Mk2",
          "product_id": "CSAFPID-31001",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:welotec:egos:*:*:*:*:*:*:eg400_mk2:*"
          }
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "egOS <1.11.2 installed on EG500",
          "product_id": "CSAFPID-31002",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:welotec:egos:*:*:*:*:*:*:eg500_mk1:*"
          }
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "egOS <1.11.2 installed on EG500 Mk2",
          "product_id": "CSAFPID-31003",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:welotec:egos:*:*:*:*:*:*:eg500_mk2:*"
          }
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "egOS <1.11.2 installed on EG600",
          "product_id": "CSAFPID-31004",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:welotec:egos:*:*:*:*:*:*:eg600_mk1:*"
          }
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11004"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "egOS <1.11.2 installed on EG600 Mk2",
          "product_id": "CSAFPID-31005",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:welotec:egos:*:*:*:*:*:*:eg600_mk2:*"
          }
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11005"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "egOS <1.11.2 installed on EG800",
          "product_id": "CSAFPID-31006",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:welotec:egos:*:*:*:*:*:*:eg800_mk1:*"
          }
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11006"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "egOS 1.11.2 installed on EG400 Mk2",
          "product_id": "CSAFPID-32001",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:welotec:egos:1.11.2:*:*:*:*:*:eg400_mk2:*"
          }
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "egOS 1.11.2 installed on EG500",
          "product_id": "CSAFPID-32002",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:welotec:egos:1.11.2:*:*:*:*:*:eg500_mk1:*"
          }
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "egOS 1.11.2 installed on EG500 Mk2",
          "product_id": "CSAFPID-32003",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:welotec:egos:1.11.2:*:*:*:*:*:eg500_mk2:*"
          }
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "egOS 1.11.2 installed on EG600",
          "product_id": "CSAFPID-32004",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:welotec:egos:1.11.2:*:*:*:*:*:eg600_mk1:*"
          }
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11004"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "egOS 1.11.2 installed on EG600 Mk2",
          "product_id": "CSAFPID-32005",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:welotec:egos:1.11.2:*:*:*:*:*:eg600_mk2:*"
          }
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11005"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "egOS 1.11.2 installed on EG800",
          "product_id": "CSAFPID-32006",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:welotec:egos:1.11.2:*:*:*:*:*:eg800_mk1:*"
          }
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11006"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-113470",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2.",
          "title": "CVE description"
        },
        {
          "category": "details",
          "text": "CVE-2026-113470 was selected because it tracks Mozilla's response to the compromise of the eMudhra intermediate CA certificates. Although the published CVE description refers to Firefox, the underlying certificate trust issue is also relevant to egOS: the egOS system CA certificate bundle is derived from the Mozilla NSS root store and contained the affected emSign trust anchors. In coordination with CERT@VDE, this CVE was therefore chosen as the closest applicable published identifier.",
          "title": "Vulnerability Characterisation"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVSS v4.0 Score: 6.3 / Medium",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "There is no supported customer-performable workaround for removing the affected certificates from the devices. Until the fixed egOS version can be installed, restrict egOS communication to trusted networks and use network segmentation or a trusted VPN where operationally possible. Prevent untrusted parties from gaining a man-in-the-middle position on network paths used by the affected devices. Monitor affected devices and connected services for unexpected TLS endpoints, certificate changes, and anomalous network activity.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update egOS on all affected products to version 1.11.2 or later. The fixed release removes the affected emSign certificates from the system trust store. This update does not modify CA certificate bundles contained in Docker images; operators must assess deployed container images separately and update or rebuild them as necessary.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "environmentalScore": 5.4,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 5.4,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006"
          ]
        }
      ],
      "title": "Cryptographic issue in the Security Block-lists, Allow-lists, and other State component"
    }
  ]
}