Summary
Multiple vulnerabilities in the web-based management functions of the affected Welotec routers, including VPN-related functions, may allow a remote attacker with high privileges to inject commands or trigger a buffer overflow. Successful exploitation may result in command execution with root privileges or a denial of service.
Impact
Affected Product(s)
| Model no. | Product name | Affected versions |
|---|---|---|
| TK102L, TK102W | TK100 | vers:semver/>=0.0.0|<3.5.116 |
| TK525L-v2, TK525L-W-v2, TK525W-v2, TK535L1-v2 | TK500-v2 | vers:semver/>=0.0.0|<1.0.124 |
| TK525L-v3, TK525L-W-G-v3, TK525L-IO-v3, TK525L-W-v3, TK525W-v3, TK555L-v3 | TK500-v3 | vers:semver/>=0.0.0|<1.0.123 |
Vulnerabilities
Expand / Collapse allImproper input validation in the IPsec VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.
Improper input validation in the Digital I/O function may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges.
Improper input validation in the WireGuard VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.
Improper input validation in the ZeroTier VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.
Improper input validation in management control functions may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges.
Insufficient bounds checking in the Digital I/O function may allow a remote attacker with high privileges to cause a denial of service.
Acknowledgments
Welotec GmbH thanks the following parties for their efforts:
- CERT@VDE for coordination (see https://certvde.com )
Revision History
| Version | Date | Summary |
|---|---|---|
| 1.0.0 | 03.11.2026 11:00 | Initial release. |