Read the docs
TI-2026-84178 Aliases CVE-2026-105979GHSA-5hc8-wr2r-5gjx

Command injection in Welotec TK100 and TK500 ZeroTier VPN

Priority LOW 37CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

Welotec TK100, TK500-v2 and TK500-v3 devices contain improper input validation in the ZeroTier VPN function. A remote attacker with high privileges can inject system commands (CWE-77) and run them with root privileges.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Improper input validation in the ZeroTier VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.

Why it matters now

EPSS 0.00358 29th percentileScored 2026-11-07
Fix Fixed TK100 (Welotec): 3.5.116TK500-v2 (Welotec): 1.0.124+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
WelotecTK1000.0.0 to before 3.5.1163.5.116Patch availableCNA
WelotecTK500-v20.0.0 to before 1.0.1241.0.124Patch availableCNA
WelotecTK500-v30.0.0 to before 1.0.1231.0.123Patch availableCNA
  • TK100 VendorWelotec Affected 0.0.0 to before 3.5.116 Fixed in 3.5.116 Patch available CNA
  • TK500-v2 VendorWelotec Affected 0.0.0 to before 1.0.124 Fixed in 1.0.124 Patch available CNA
  • TK500-v3 VendorWelotec Affected 0.0.0 to before 1.0.123 Fixed in 1.0.123 Patch available CNA

Remediation

Update Welotec TK100 to 3.5.116, TK500-v2 to 1.0.124 and TK500-v3 to 1.0.123.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA TK100 (Welotec) Fixed in 3.5.116
  • Fix · CNA TK500-v2 (Welotec) Fixed in 1.0.124
  • Fix · CNA TK500-v3 (Welotec) Fixed in 1.0.123

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Welotec TK100, TK500-v2, TK500-v3 1.0.123, 1.0.124, 3.5.116

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2026-84181 Command injection in Welotec IPsec VPNPriority MEDIUM 40
    • TI-2026-84180 Command Injection in Welotec Digital I/OPriority LOW 39
    • TI-2026-84179 Command injection in Welotec WireGuard VPN functionPriority LOW 39
    Show all 6 records →

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-105979
  2. 2026-11-03 Alias added: GHSA-5hc8-wr2r-5gjx
  3. 2026-11-04 Priority changed: MEDIUM → LOW

References

Other 1

  • TI-2023-01026 Welotec: improper access control in TK500v1 router series CVSS 3.1CRITICAL 9.8
  • TI-2025-27665 egOS WebGUI Hard-Coded JWT Secret Enables Authentication Bypass CVSS 3.1CRITICAL 9.8
  • TI-2023-01025 Welotec: Command injection vulnerability in TK500v1 router series CVSS 3.1HIGH 8.8
  • TI-2025-27677 Path Traversal via 'Upload-Key' in SmartEMS Upload Handling CVSS 3.1HIGH 8.8
  • TI-2026-84181 Command injection in Welotec IPsec VPN CVSS 4.0HIGH 8.6
  • TI-2026-84180 Command Injection in Welotec Digital I/O CVSS 4.0HIGH 8.6
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences