Plan ahead Medium Check your exposure
Welotec egOS trusts certificates from compromised eMudhra signing keys
CERT@VDE advisoriesWelotec, eMudhra, Mozilla
What happened. CERT@VDE reports that the egOS trust store, built from the Mozilla root store, holds eMudhra emSign root certificates linked to eight compromised intermediate keys. An attacker with a key who can intercept traffic could forge TLS certificates and read or change the device's outgoing traffic.
Who is affected. Users of Welotec egOS devices. The advisory does not list versions or sectors.
What to do. Check whether you run Welotec egOS and read advisory VDE-2026-138 for the vendor's remediation. Review which remote services your devices reach over TLS.
When to act. Plan ahead: Welotec egOS users: review certificate trust and device exposure; no exploitation is stated.
Editor's reading
Forasset ownerOT security leadvendor/integrator
- Purdue level
- L3.5
- L1
Why: Welotec egOS runs on industrial edge devices and routers that make outgoing TLS connections, but the advisory does not name a specific device role, so the levels are inferred.
- Are you exposed?
Check your asset inventory for Welotec devices running egOS and see whether they make outgoing TLS connections to remote services.
- If you cannot fix it yet
- Restrict egOS devices to connect only to known, trusted remote services through a firewall.
- Keep device traffic on trusted network paths where an attacker cannot intercept it.
- Remove or distrust the eMudhra emSign roots in the trust store if the vendor guidance allows it.
- Watch for
- Watch for TLS certificates issued by eMudhra emSign on connections from egOS devices to services that normally use other authorities.
- Look for unexpected changes in the certificate presented by services that egOS devices contact.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: CERT@VDE advisories (opens certvde.com)
More on Welotec