Read the docs
TI-2026-84182 Aliases CVE-2026-109161GHSA-g5h3-rrm5-w5mh

Buffer overflow in Welotec Digital I/O function causes denial of service

Priority LOW 30CWE-120Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.

Summary

Welotec TK100 firmware before 3.5.116, TK500-v2 firmware before 1.0.124, and TK500-v3 firmware before 1.0.123 are affected. Insufficient bounds checking in the Digital I/O function lets a remote attacker with high privileges write past a buffer (CWE-120). The attacker can cause a denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Insufficient bounds checking in the Digital I/O function may allow a remote attacker with high privileges to cause a denial of service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.003 22nd percentileScored 2026-11-07
Fix Fixed TK100 (Welotec): 3.5.116TK500-v2 (Welotec): 1.0.124+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WelotecTK1000.0.0 to before 3.5.1163.5.116Patch availableCNA
WelotecTK500-v20.0.0 to before 1.0.1241.0.124Patch availableCNA
WelotecTK500-v30.0.0 to before 1.0.1231.0.123Patch availableCNA
  • TK100 VendorWelotec Affected 0.0.0 to before 3.5.116 Fixed in 3.5.116 Patch available CNA
  • TK500-v2 VendorWelotec Affected 0.0.0 to before 1.0.124 Fixed in 1.0.124 Patch available CNA
  • TK500-v3 VendorWelotec Affected 0.0.0 to before 1.0.123 Fixed in 1.0.123 Patch available CNA

Remediation

Update TK100 to 3.5.116, TK500-v2 to 1.0.124, and TK500-v3 to 1.0.123.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA TK100 (Welotec) Fixed in 3.5.116
  • Fix · CNA TK500-v2 (Welotec) Fixed in 1.0.124
  • Fix · CNA TK500-v3 (Welotec) Fixed in 1.0.123

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Welotec TK100, TK500-v2, TK500-v3 1.0.123, 1.0.124, 3.5.116

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2026-84181 Command injection in Welotec IPsec VPNPriority MEDIUM 40
    • TI-2026-84180 Command Injection in Welotec Digital I/OPriority LOW 39
    • TI-2026-84179 Command injection in Welotec WireGuard VPN functionPriority LOW 39
    Show all 6 records →

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-109161
  2. 2026-11-03 Alias added: GHSA-g5h3-rrm5-w5mh
  3. 2026-11-04 Priority changed: MEDIUM → LOW
  4. 2026-11-07 CISA SSVC decision points changed

References

Other 1

  • TI-2023-01026 Welotec: improper access control in TK500v1 router series CVSS 3.1CRITICAL 9.8
  • TI-2025-27665 egOS WebGUI Hard-Coded JWT Secret Enables Authentication Bypass CVSS 3.1CRITICAL 9.8
  • TI-2023-01025 Welotec: Command injection vulnerability in TK500v1 router series CVSS 3.1HIGH 8.8
  • TI-2025-27677 Path Traversal via 'Upload-Key' in SmartEMS Upload Handling CVSS 3.1HIGH 8.8
  • TI-2026-84181 Command injection in Welotec IPsec VPN CVSS 4.0HIGH 8.6
  • TI-2026-84180 Command Injection in Welotec Digital I/O CVSS 4.0HIGH 8.6
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences