Read the docs
TI-2024-03649 Aliases CVE-2024-3911GHSA-756q-jvx3-cfqc

Welotec: Clickjacking Vulnerability in WebUI

Priority LOW 29CWE-1021Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-1021.

Summary

An unauthenticated remote attacker can deceive users into performing unintended actions due to improper restriction of rendered UI layers or frames.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00456 39th percentileScored 2026-11-07
Fix Fixed SMART EMS (Welotec): 3.1.4VPN Security Suite (Welotec): 3.1.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WelotecSMART EMSbefore 3.1.43.1.4Patch availableCNA
WelotecVPN Security Suitebefore 3.1.43.1.4Patch availableCNA
  • SMART EMS VendorWelotec Affected before 3.1.4 Fixed in 3.1.4 Patch available CNA
  • VPN Security Suite VendorWelotec Affected before 3.1.4 Fixed in 3.1.4 Patch available CNA

Remediation

  • Fix · CNA SMART EMS (Welotec) Fixed in 3.1.4
  • Fix · CNA VPN Security Suite (Welotec) Fixed in 3.1.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-3911
  2. 2026-10-03 Alias added: GHSA-756q-jvx3-cfqc

References

Other 1

  • TI-2023-01026 Welotec: improper access control in TK500v1 router series CVSS 3.1CRITICAL 9.8
  • TI-2025-27665 egOS WebGUI Hard-Coded JWT Secret Enables Authentication Bypass CVSS 3.1CRITICAL 9.8
  • TI-2023-01025 Welotec: Command injection vulnerability in TK500v1 router series CVSS 3.1HIGH 8.8
  • TI-2025-27677 Path Traversal via 'Upload-Key' in SmartEMS Upload Handling CVSS 3.1HIGH 8.8
  • TI-2026-84181 Command injection in Welotec IPsec VPN CVSS 4.0HIGH 8.6
  • TI-2026-84180 Command Injection in Welotec Digital I/O CVSS 4.0HIGH 8.6
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences