VDE-2026-138
Nov. 11, 2026, 8:00 nachm.
The egOS system trust store uses certificate data from the Mozilla NSS root store. The trust store contains eMudhra emSign root certificates associated with eight compromised intermediate certificate authority keys. …
VDE-2026-119
Nov. 3, 2026, 11:00 vorm.
Multiple vulnerabilities in the web-based management functions of the affected Welotec routers, including VPN-related functions, may allow a remote attacker with high privileges to inject commands or trigger a buffer …
VDE-2026-127
Okt. 29, 2026, 11:00 vorm.
Two memory-safety vulnerabilities in the PHP runtime bundled with SMART EMS allow an unauthenticated remote attacker to execute arbitrary code in the context of the PHP web worker. All SMART …
VDE-2025-085
Sept. 22, 2025, 10:00 vorm.
A path traversal flaw in the SmartEMS upload handling allows authenticated users to direct upload data outside of the intended directory via the 'Upload-Key' header. In deployments where writable, code-interpreted …
VDE-2025-076
Aug. 26, 2025, 9:00 vorm.
A hard-coded JWT secret in the egOS WebGUI backend is readable to the default user, allowing attackers to forge valid tokens and access protected API endpoints.
VDE-2024-043
Aug. 22, 2024, 8:00 vorm.
Products from the Edge Gateway Family are affected by recently published so called RegreSSHion vulnerability.
VDE-2024-023
April 23, 2024, 10:00 vorm.
Welotec has been informed by an external source that the WebUI of the device management solution "SMART EMS" and the remote connectivity solution "VPN Security Suite" is vulnerable to so-called …
VDE-2024-009
Mai 14, 2025, 2:28 nachm.
Welotec has closed two vulnerabilities in the TK500v1 router series and advises to update the routers to firmware version r5542 or later. An exploitation of the vulnerabilities can allow an …