Read the docs
TI-2023-01026 Aliases CVE-2023-1083GHSA-73qm-xvq7-vqwg

Welotec: improper access control in TK500v1 router series

Priority MEDIUM 50CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

An unauthenticated remote attacker who is aware of a MQTT topic name can send and receive messages, including GET/SET configuration commands, reboot commands and firmware updates.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00679 52nd percentileScored 2026-11-07
Fix Fixed TK515L (Welotec): v2.3.0.r5542TK515L Set (Welotec): v2.3.0.r5542+12 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WelotecTK515Lbefore v2.3.0.r5542v2.3.0.r5542Patch availableCNA
WelotecTK515L Setbefore v2.3.0.r5542v2.3.0.r5542Patch availableCNA
WelotecTK515L-Wbefore v2.3.0.r5542v2.3.0.r5542Patch availableCNA
WelotecTK515L-W Setbefore v2.3.0.r5542v2.3.0.r5542Patch availableCNA
WelotecTK525Lbefore v2.3.0.r5542v2.3.0.r5542Patch availableCNA
WelotecTK525L Setbefore v2.3.0.r5542v2.3.0.r5542Patch availableCNA
WelotecTK525L-Wbefore v2.3.0.r5542v2.3.0.r5542Patch availableCNA
WelotecTK525L-W Setbefore v2.3.0.r5542v2.3.0.r5542Patch availableCNA
WelotecTK525Ubefore v2.3.0.r5542v2.3.0.r5542Patch availableCNA
WelotecTK525U Setbefore v2.3.0.r5542v2.3.0.r5542Patch availableCNA
WelotecTK525Wbefore v2.3.0.r5542v2.3.0.r5542Patch availableCNA
WelotecTK525W Setbefore v2.3.0.r5542v2.3.0.r5542Patch availableCNA
WelotecTK535L1before v2.3.0.r5542v2.3.0.r5542Patch availableCNA
WelotecTK535L1 Setbefore v2.3.0.r5542v2.3.0.r5542Patch availableCNA
  • TK515L VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA
  • TK515L Set VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA
  • TK515L-W VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA
  • TK515L-W Set VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA
  • TK525L VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA
  • TK525L Set VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA
  • TK525L-W VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA
  • TK525L-W Set VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA
  • TK525U VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA
  • TK525U Set VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA
  • TK525W VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA
  • TK525W Set VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA
  • TK535L1 VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA
  • TK535L1 Set VendorWelotec Affected before v2.3.0.r5542 Fixed in v2.3.0.r5542 Patch available CNA

CPE names CISA-ADP · 5

CPEVersionsRoleVendor
cpe:2.3:h:welotec:tk515l:*:*:*:*:*:*:*:*——Welotec
cpe:2.3:h:welotec:tk525l:*:*:*:*:*:*:*:*——Welotec
cpe:2.3:h:welotec:tk525u:*:*:*:*:*:*:*:*——Welotec
cpe:2.3:h:welotec:tk525w:*:*:*:*:*:*:*:*——Welotec
cpe:2.3:h:welotec:tk535l1:*:*:*:*:*:*:*:*——Welotec
  • cpe:2.3:h:welotec:tk515l:*:*:*:*:*:*:*:* Versions — — ·Welotec
  • cpe:2.3:h:welotec:tk525l:*:*:*:*:*:*:*:* Versions — — ·Welotec
  • cpe:2.3:h:welotec:tk525u:*:*:*:*:*:*:*:* Versions — — ·Welotec
  • cpe:2.3:h:welotec:tk525w:*:*:*:*:*:*:*:* Versions — — ·Welotec
  • cpe:2.3:h:welotec:tk535l1:*:*:*:*:*:*:*:* Versions — — ·Welotec

Remediation

  • Fix · CNA TK515L (Welotec) Fixed in v2.3.0.r5542
  • Fix · CNA TK515L Set (Welotec) Fixed in v2.3.0.r5542
  • Fix · CNA TK515L-W (Welotec) Fixed in v2.3.0.r5542
  • Fix · CNA TK515L-W Set (Welotec) Fixed in v2.3.0.r5542
  • Fix · CNA TK525L (Welotec) Fixed in v2.3.0.r5542
  • Fix · CNA TK525L Set (Welotec) Fixed in v2.3.0.r5542
  • Fix · CNA TK525L-W (Welotec) Fixed in v2.3.0.r5542
  • Fix · CNA TK525L-W Set (Welotec) Fixed in v2.3.0.r5542
  • Fix · CNA TK525U (Welotec) Fixed in v2.3.0.r5542
  • Fix · CNA TK525U Set (Welotec) Fixed in v2.3.0.r5542
  • Fix · CNA TK525W (Welotec) Fixed in v2.3.0.r5542
  • Fix · CNA TK525W Set (Welotec) Fixed in v2.3.0.r5542
  • Fix · CNA TK535L1 (Welotec) Fixed in v2.3.0.r5542
  • Fix · CNA TK535L1 Set (Welotec) Fixed in v2.3.0.r5542

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Welotec TK515L, TK515L Set and 12 more products v2.3.0.r5542

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2023-01025 Welotec: Command injection vulnerability in TK500v1 router seriesPriority MEDIUM 42
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-1083
  2. 2026-10-03 Alias added: GHSA-73qm-xvq7-vqwg

References

Other 1

  • TI-2025-27665 egOS WebGUI Hard-Coded JWT Secret Enables Authentication Bypass CVSS 3.1CRITICAL 9.8
  • TI-2023-01025 Welotec: Command injection vulnerability in TK500v1 router series CVSS 3.1HIGH 8.8
  • TI-2025-27677 Path Traversal via 'Upload-Key' in SmartEMS Upload Handling CVSS 3.1HIGH 8.8
  • TI-2026-84181 Command injection in Welotec IPsec VPN CVSS 4.0HIGH 8.6
  • TI-2026-84180 Command Injection in Welotec Digital I/O CVSS 4.0HIGH 8.6
  • TI-2026-84179 Command injection in Welotec WireGuard VPN function CVSS 4.0HIGH 8.6
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences