Read the docs
TI-2023-01025 Aliases CVE-2023-1082GHSA-3gw6-fj56-vc35

Welotec: Command injection vulnerability in TK500v1 router series

Priority MEDIUM 42CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

An remote attacker with low privileges can perform a command injection which can lead to root access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0098 62nd percentileScored 2026-11-07
Fix Fixed TK515L (Welotec): v2.3.0.r5542TK515L Set (Welotec): v2.3.0.r5542+12 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WelotecTK515Lbefore v2.3.0.r5542v2.3.0.r5542Patch availableCNA
WelotecTK515L Setbefore v2.3.0.r5542v2.3.0.r5542Patch availableCNA
WelotecTK515L-Wbefore v2.3.0.r5542v2.3.0.r5542Patch availableCNA
WelotecTK515L-W Setbefore v2.3.0.r5542v2.3.0.r5542Patch availableCNA
WelotecTK525Lbefore v2.3.0.r5542v2.3.0.r5542Patch availableCNA
WelotecTK525L Setbefore v2.3.0.r5542v2.3.0.r5542Patch availableCNA
WelotecTK525L-Wbefore v2.3.0.r5542v2.3.0.r5542Patch availableCNA
WelotecTK525L-W Setbefore v2.3.0.r5542v2.3.0.r5542Patch availableCNA
WelotecTK525Ubefore v2.3.0.r5542v2.3.0.r5542Patch availableCNA
WelotecTK525U Setbefore v2.3.0.r5542v2.3.0.r5542Patch availableCNA
WelotecTK525Wbefore v2.3.0.r5542v2.3.0.r5542Patch availableCNA
WelotecTK525W Setbefore v2.3.0.r5542v2.3.0.r5542Patch availableCNA
WelotecTK535L1before v2.3.0.r5542v2.3.0.r5542Patch availableCNA
WelotecTK535L1 Setbefore v2.3.0.r5542v2.3.0.r5542Patch availableCNA
  • TK515L VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA
  • TK515L Set VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA
  • TK515L-W VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA
  • TK515L-W Set VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA
  • TK525L VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA
  • TK525L Set VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA
  • TK525L-W VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA
  • TK525L-W Set VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA
  • TK525U VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA
  • TK525U Set VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA
  • TK525W VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA
  • TK525W Set VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA
  • TK535L1 VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA
  • TK535L1 Set VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA

CPE names CISA-ADP · 14

CPEVersionsRoleVendor
cpe:2.3:h:welotec:tk515l:*:*:*:*:*:*:*:*——Welotec
cpe:2.3:h:welotec:tk515l_set:*:*:*:*:*:*:*:*——Welotec
cpe:2.3:h:welotec:tk515l-w:*:*:*:*:*:*:*:*——Welotec
cpe:2.3:h:welotec:tk515l-w_set:*:*:*:*:*:*:*:*——Welotec
cpe:2.3:h:welotec:tk525l:*:*:*:*:*:*:*:*——Welotec
cpe:2.3:h:welotec:tk525l_set:*:*:*:*:*:*:*:*——Welotec
cpe:2.3:h:welotec:tk525l-w:*:*:*:*:*:*:*:*——Welotec
cpe:2.3:h:welotec:tk525l-w_set:*:*:*:*:*:*:*:*——Welotec
cpe:2.3:h:welotec:tk525u:*:*:*:*:*:*:*:*——Welotec
cpe:2.3:h:welotec:tk525u_set:*:*:*:*:*:*:*:*——Welotec
  • cpe:2.3:h:welotec:tk515l:*:*:*:*:*:*:*:* Versions — — ·Welotec
  • cpe:2.3:h:welotec:tk515l_set:*:*:*:*:*:*:*:* Versions — — ·Welotec
  • cpe:2.3:h:welotec:tk515l-w:*:*:*:*:*:*:*:* Versions — — ·Welotec
  • cpe:2.3:h:welotec:tk515l-w_set:*:*:*:*:*:*:*:* Versions — — ·Welotec
  • cpe:2.3:h:welotec:tk525l:*:*:*:*:*:*:*:* Versions — — ·Welotec
  • cpe:2.3:h:welotec:tk525l_set:*:*:*:*:*:*:*:* Versions — — ·Welotec
  • cpe:2.3:h:welotec:tk525l-w:*:*:*:*:*:*:*:* Versions — — ·Welotec
  • cpe:2.3:h:welotec:tk525l-w_set:*:*:*:*:*:*:*:* Versions — — ·Welotec
  • cpe:2.3:h:welotec:tk525u:*:*:*:*:*:*:*:* Versions — — ·Welotec
  • cpe:2.3:h:welotec:tk525u_set:*:*:*:*:*:*:*:* Versions — — ·Welotec
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:welotec:tk525w:*:*:*:*:*:*:*:*——Welotec
cpe:2.3:h:welotec:tk525w_set:*:*:*:*:*:*:*:*——Welotec
cpe:2.3:h:welotec:tk535l1:*:*:*:*:*:*:*:*——Welotec
cpe:2.3:h:welotec:tk535l1_set:*:*:*:*:*:*:*:*——Welotec
  • cpe:2.3:h:welotec:tk525w:*:*:*:*:*:*:*:* Versions — — ·Welotec
  • cpe:2.3:h:welotec:tk525w_set:*:*:*:*:*:*:*:* Versions — — ·Welotec
  • cpe:2.3:h:welotec:tk535l1:*:*:*:*:*:*:*:* Versions — — ·Welotec
  • cpe:2.3:h:welotec:tk535l1_set:*:*:*:*:*:*:*:* Versions — — ·Welotec

Remediation

  • Fix · CNA TK515L (Welotec) Fixed in v2.3.0.r5542
  • Fix · CNA TK515L Set (Welotec) Fixed in v2.3.0.r5542
  • Fix · CNA TK515L-W (Welotec) Fixed in v2.3.0.r5542
  • Fix · CNA TK515L-W Set (Welotec) Fixed in v2.3.0.r5542
  • Fix · CNA TK525L (Welotec) Fixed in v2.3.0.r5542
  • Fix · CNA TK525L Set (Welotec) Fixed in v2.3.0.r5542
  • Fix · CNA TK525L-W (Welotec) Fixed in v2.3.0.r5542
  • Fix · CNA TK525L-W Set (Welotec) Fixed in v2.3.0.r5542
  • Fix · CNA TK525U (Welotec) Fixed in v2.3.0.r5542
  • Fix · CNA TK525U Set (Welotec) Fixed in v2.3.0.r5542
  • Fix · CNA TK525W (Welotec) Fixed in v2.3.0.r5542
  • Fix · CNA TK525W Set (Welotec) Fixed in v2.3.0.r5542
  • Fix · CNA TK535L1 (Welotec) Fixed in v2.3.0.r5542
  • Fix · CNA TK535L1 Set (Welotec) Fixed in v2.3.0.r5542

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Welotec TK515L, TK515L Set and 12 more products v2.3.0.r5542

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2023-01026 Welotec: improper access control in TK500v1 router seriesPriority MEDIUM 50
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-1082
  2. 2026-10-03 Alias added: GHSA-3gw6-fj56-vc35

References

Other 1

  • TI-2023-01026 Welotec: improper access control in TK500v1 router series CVSS 3.1CRITICAL 9.8
  • TI-2025-27665 egOS WebGUI Hard-Coded JWT Secret Enables Authentication Bypass CVSS 3.1CRITICAL 9.8
  • TI-2025-27677 Path Traversal via 'Upload-Key' in SmartEMS Upload Handling CVSS 3.1HIGH 8.8
  • TI-2026-84181 Command injection in Welotec IPsec VPN CVSS 4.0HIGH 8.6
  • TI-2026-84180 Command Injection in Welotec Digital I/O CVSS 4.0HIGH 8.6
  • TI-2026-84179 Command injection in Welotec WireGuard VPN function CVSS 4.0HIGH 8.6
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences