Vulnerability · Published Nov 10, 2025 · Assigned by CERTVDE
CVE-2025-41731Jumo: Insufficient entropy in PRNG may lead to root access
High 7.4
In plain English
A high-severity security flaw in variTRON300 from Jumo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.1%top 96.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability was identified in the password generation algorithm when accessing the debug-interface. An unauthenticated local attacker with knowledge of the password generation timeframe might be able to brute force the password in a timely manner and thus gain root access to the device if the debug interface is still enabled.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Jumo | variTRON300 | 0.0.0.0 – before 9.0.2.5 |
| Jumo | variTRON500 | 0.0.0.0 – before 9.0.2.5 |
| Jumo | variTRON500 touch | 0.0.0.0 – before 9.0.2.5 |
Weakness: CWE-338 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H