Read the docs
TI-2026-84181 Aliases CVE-2026-105982GHSA-8mvm-3gqr-9wc8

Command injection in Welotec IPsec VPN

Priority MEDIUM 40CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

Welotec TK100 before 3.5.116, TK500-v2 before 1.0.124 and TK500-v3 before 1.0.123 are affected. Improper input validation in the IPsec VPN function (CWE-77) lets a remote attacker with high privileges inject system commands. The injected commands run with root privileges.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Improper input validation in the IPsec VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00466 40th percentileScored 2026-11-07
Fix Fixed TK100 (Welotec): 3.5.116TK500-v2 (Welotec): 1.0.124+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WelotecTK1000.0.0 to before 3.5.1163.5.116Patch availableCNA
WelotecTK500-v20.0.0 to before 1.0.1241.0.124Patch availableCNA
WelotecTK500-v30.0.0 to before 1.0.1231.0.123Patch availableCNA
  • TK100 VendorWelotec Affected 0.0.0 to before 3.5.116 Fixed in 3.5.116 Patch available CNA
  • TK500-v2 VendorWelotec Affected 0.0.0 to before 1.0.124 Fixed in 1.0.124 Patch available CNA
  • TK500-v3 VendorWelotec Affected 0.0.0 to before 1.0.123 Fixed in 1.0.123 Patch available CNA

Remediation

Update Welotec TK100 to version 3.5.116, TK500-v2 to version 1.0.124 and TK500-v3 to version 1.0.123.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA TK100 (Welotec) Fixed in 3.5.116
  • Fix · CNA TK500-v2 (Welotec) Fixed in 1.0.124
  • Fix · CNA TK500-v3 (Welotec) Fixed in 1.0.123

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Welotec TK100, TK500-v2, TK500-v3 1.0.123, 1.0.124, 3.5.116

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2026-84180 Command Injection in Welotec Digital I/OPriority LOW 39
    • TI-2026-84179 Command injection in Welotec WireGuard VPN functionPriority LOW 39
    • TI-2026-84177 Command injection in Welotec management control functionsPriority LOW 39
    Show all 6 records →

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-105982
  2. 2026-11-03 Alias added: GHSA-8mvm-3gqr-9wc8
  3. 2026-11-03 CISA SSVC decision points changed
  4. 2026-11-03 Priority changed: MEDIUM → LOW
  5. 2026-11-04 Priority changed: LOW → MEDIUM

References

Other 1

  • TI-2023-01026 Welotec: improper access control in TK500v1 router series CVSS 3.1CRITICAL 9.8
  • TI-2025-27665 egOS WebGUI Hard-Coded JWT Secret Enables Authentication Bypass CVSS 3.1CRITICAL 9.8
  • TI-2023-01025 Welotec: Command injection vulnerability in TK500v1 router series CVSS 3.1HIGH 8.8
  • TI-2025-27677 Path Traversal via 'Upload-Key' in SmartEMS Upload Handling CVSS 3.1HIGH 8.8
  • TI-2026-84180 Command Injection in Welotec Digital I/O CVSS 4.0HIGH 8.6
  • TI-2026-84179 Command injection in Welotec WireGuard VPN function CVSS 4.0HIGH 8.6
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences