VDE-2026-119
Vulnerability from csaf_welotecgmbh - Published: 2026-11-03 10:00 - Updated: 2026-11-03 10:00Summary
Welotec: Multiple vulnerabilities in TK routers
Severity
High
Notes
Summary: Multiple vulnerabilities in the web-based management functions of the affected Welotec routers, including VPN-related functions, may allow a remote attacker with high privileges to inject commands or trigger a buffer overflow. Successful exploitation may result in command execution with root privileges or a denial of service.
Impact: Successful exploitation of the command injection vulnerabilities may allow an attacker with high privileges to gain complete control of an affected router with root privileges. The attacker could read or modify configuration and data, disrupt network connectivity, install persistent software, or use the router as a foothold for further attacks. Exploitation of the buffer overflow condition may additionally cause the affected service or router to become unavailable.
Mitigation: Do not expose the management interface to the internet or other untrusted networks. Restrict management access to trusted administrator workstations using network segmentation and firewall rules. Disable ZeroTier, WireGuard, IPsec, and Digital I/O functions when they are not required and where this is operationally possible. Monitor affected devices for unexpected configuration changes, processes, user accounts, and outbound network connections.
Remediation: Update the affected products to the following firmware versions or later:
| Product Series / Hardware Revision | Firmware Version |
|---|---|
| TK100 | v3.5.116 |
| TK500-v2 | v1.0.124 |
| TK500-v3 | v1.0.123 |
Improper input validation in management control functions may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges.
7.2 (High)
Mitigation
Do not expose the management interface to the internet or other untrusted networks. Restrict management access to trusted administrator workstations using network segmentation and firewall rules.
Vendor Fix
Update TK100 to firmware v3.5.116 or later, TK500-v2 to firmware v1.0.124 or later, and TK500-v3 to firmware v1.0.123 or later.
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Welotec TK100 firmware v3.5.116
Welotec / Industrial Routers / TK100
|
TK102LTK102W
cpe:2.3:h:welotec:tk100:3.5.116:*:*:*:*:*:*:*
6912TK102L006912TK102W00
|
v3.5.116 | |
|
Welotec TK500-v2 firmware v1.0.124
Welotec / Industrial Routers / TK500-v2
|
TK525L-v2TK525L-W-v2TK525W-v2TK535L1-v2
cpe:2.3:h:welotec:tk500-v2:1.0.124:*:*:*:*:*:*:*
6912TK525L0N6912TK525LWN6912TK525W0N6912TK535L0N
|
v1.0.124 | |
|
Welotec TK500-v3 firmware v1.0.123
Welotec / Industrial Routers / TK500-v3
|
TK525L-v3TK525L-W-G-v3TK525L-IO-v3TK525L-W-v3TK525W-v3TK555L-v3
cpe:2.3:h:welotec:tk500-v3:1.0.123:*:*:*:*:*:*:*
6912TK525L036912TK525LG36912TK525LIO6912TK525LW36912TK525W036912TK555L03
|
v1.0.123 |
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Welotec TK100 firmware <v3.5.116
Welotec / Industrial Routers / TK100
|
TK102LTK102W
cpe:2.3:h:welotec:tk100:*:*:*:*:*:*:*:*
6912TK102L006912TK102W00
|
vers:semver/>=0.0.0|<3.5.116 | |
|
Welotec TK500-v2 firmware <v1.0.124
Welotec / Industrial Routers / TK500-v2
|
TK525L-v2TK525L-W-v2TK525W-v2TK535L1-v2
cpe:2.3:h:welotec:tk500-v2:*:*:*:*:*:*:*:*
6912TK525L0N6912TK525LWN6912TK525W0N6912TK535L0N
|
vers:semver/>=0.0.0|<1.0.124 | |
|
Welotec TK500-v3 firmware <v1.0.123
Welotec / Industrial Routers / TK500-v3
|
TK525L-v3TK525L-W-G-v3TK525L-IO-v3TK525L-W-v3TK525W-v3TK555L-v3
cpe:2.3:h:welotec:tk500-v3:*:*:*:*:*:*:*:*
6912TK525L036912TK525LG36912TK525LIO6912TK525LW36912TK525W036912TK555L03
|
vers:semver/>=0.0.0|<1.0.123 |
Improper input validation in the ZeroTier VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.
7.2 (High)
Mitigation
Do not expose the management interface to the internet or other untrusted networks. Restrict management access to trusted administrator workstations using network segmentation and firewall rules. Disable ZeroTier when it is not required and where this is operationally possible.
Vendor Fix
Update TK100 to firmware v3.5.116 or later, TK500-v2 to firmware v1.0.124 or later, and TK500-v3 to firmware v1.0.123 or later.
Affected products
Fixed
3 products, the same list as for
CVE-2026-105978
Known affected
3 products, the same list as for
CVE-2026-105978
Improper input validation in the WireGuard VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.
7.2 (High)
Mitigation
Do not expose the management interface to the internet or other untrusted networks. Restrict management access to trusted administrator workstations using network segmentation and firewall rules. Disable WireGuard when it is not required and where this is operationally possible.
Vendor Fix
Update TK100 to firmware v3.5.116 or later, TK500-v2 to firmware v1.0.124 or later, and TK500-v3 to firmware v1.0.123 or later.
Affected products
Fixed
3 products, the same list as for
CVE-2026-105978
Known affected
3 products, the same list as for
CVE-2026-105978
Improper input validation in the Digital I/O function may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges.
7.2 (High)
Mitigation
Do not expose the management interface to the internet or other untrusted networks. Restrict management access to trusted administrator workstations using network segmentation and firewall rules. Disable Digital I/O when it is not required and where this is operationally possible.
Vendor Fix
Update TK100 to firmware v3.5.116 or later, TK500-v2 to firmware v1.0.124 or later, and TK500-v3 to firmware v1.0.123 or later.
Affected products
Fixed
3 products, the same list as for
CVE-2026-105978
Known affected
3 products, the same list as for
CVE-2026-105978
Improper input validation in the IPsec VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.
7.2 (High)
Mitigation
Do not expose the management interface to the internet or other untrusted networks. Restrict management access to trusted administrator workstations using network segmentation and firewall rules. Disable IPsec when it is not required and where this is operationally possible.
Vendor Fix
Update TK100 to firmware v3.5.116 or later, TK500-v2 to firmware v1.0.124 or later, and TK500-v3 to firmware v1.0.123 or later.
Affected products
Fixed
3 products, the same list as for
CVE-2026-105978
Known affected
3 products, the same list as for
CVE-2026-105978
Insufficient bounds checking in the Digital I/O function may allow a remote attacker with high privileges to cause a denial of service.
4.9 (Medium)
Mitigation
Do not expose the management interface to the internet or other untrusted networks. Restrict management access to trusted administrator workstations using network segmentation and firewall rules. Disable Digital I/O when it is not required and where this is operationally possible.
Vendor Fix
Update TK100 to firmware v3.5.116 or later, TK500-v2 to firmware v1.0.124 or later, and TK500-v3 to firmware v1.0.123 or later.
Affected products
Fixed
3 products, the same list as for
CVE-2026-105978
Known affected
3 products, the same list as for
CVE-2026-105978
References
6 references
Acknowledgments
{
"document": {
"acknowledgments": [
{
"organization": "CERT@VDE",
"summary": "coordination",
"urls": [
"https://certvde.com"
]
}
],
"aggregate_severity": {
"namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale",
"text": "High"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-GB",
"notes": [
{
"category": "summary",
"text": "Multiple vulnerabilities in the web-based management functions of the affected Welotec routers, including VPN-related functions, may allow a remote attacker with high privileges to inject commands or trigger a buffer overflow. Successful exploitation may result in command execution with root privileges or a denial of service.",
"title": "Summary"
},
{
"category": "details",
"text": "Successful exploitation of the command injection vulnerabilities may allow an attacker with high privileges to gain complete control of an affected router with root privileges. The attacker could read or modify configuration and data, disrupt network connectivity, install persistent software, or use the router as a foothold for further attacks. Exploitation of the buffer overflow condition may additionally cause the affected service or router to become unavailable.",
"title": "Impact"
},
{
"category": "details",
"text": "Do not expose the management interface to the internet or other untrusted networks. Restrict management access to trusted administrator workstations using network segmentation and firewall rules. Disable ZeroTier, WireGuard, IPsec, and Digital I/O functions when they are not required and where this is operationally possible. Monitor affected devices for unexpected configuration changes, processes, user accounts, and outbound network connections.",
"title": "Mitigation"
},
{
"category": "details",
"text": "Update the affected products to the following firmware versions or later:\n\n| Product Series / Hardware Revision | Firmware Version |\n|---|---|\n| TK100 | v3.5.116 |\n| TK500-v2 | v1.0.124 |\n| TK500-v3 | v1.0.123 |",
"title": "Remediation"
}
],
"publisher": {
"category": "vendor",
"contact_details": "psirt@welotec.com",
"name": "Welotec GmbH",
"namespace": "https://welotec.com"
},
"references": [
{
"category": "external",
"summary": "Welotec PSIRT",
"url": "https://welotec.com/de/pages/coordinated-vulnerability-disclosure-policy"
},
{
"category": "external",
"summary": "CERT@VDE Security Advisories for Welotec",
"url": "https://certvde.com/de/advisories/vendor/welotec"
},
{
"category": "self",
"summary": "VDE-2026-119: Welotec: Multiple vulnerabilities in TK routers - HTML",
"url": "https://certvde.com/en/advisories/VDE-2026-119"
},
{
"category": "self",
"summary": "VDE-2026-119: Welotec: Multiple vulnerabilities in TK routers - CSAF",
"url": "https://welotec.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-119.json"
}
],
"title": "Welotec: Multiple vulnerabilities in TK routers",
"tracking": {
"aliases": [
"VDE-2026-119"
],
"current_release_date": "2026-11-03T10:00:00.000Z",
"generator": {
"date": "2026-10-28T11:15:15.599Z",
"engine": {
"name": "Secvisogram",
"version": "2.6.16"
}
},
"id": "VDE-2026-119",
"initial_release_date": "2026-11-03T10:00:00.000Z",
"revision_history": [
{
"date": "2026-11-03T10:00:00.000Z",
"number": "1.0.0",
"summary": "Initial release."
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:semver/\u003e=0.0.0|\u003c3.5.116",
"product": {
"name": "Welotec TK100 firmware \u003cv3.5.116",
"product_id": "CSAFPID-11001",
"product_identification_helper": {
"cpe": "cpe:2.3:h:welotec:tk100:*:*:*:*:*:*:*:*",
"model_numbers": [
"TK102L",
"TK102W"
],
"skus": [
"6912TK102L00",
"6912TK102W00"
]
}
}
},
{
"category": "product_version",
"name": "v3.5.116",
"product": {
"name": "Welotec TK100 firmware v3.5.116",
"product_id": "CSAFPID-12001",
"product_identification_helper": {
"cpe": "cpe:2.3:h:welotec:tk100:3.5.116:*:*:*:*:*:*:*",
"model_numbers": [
"TK102L",
"TK102W"
],
"skus": [
"6912TK102L00",
"6912TK102W00"
]
}
}
}
],
"category": "product_name",
"name": "TK100"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:semver/\u003e=0.0.0|\u003c1.0.124",
"product": {
"name": "Welotec TK500-v2 firmware \u003cv1.0.124",
"product_id": "CSAFPID-11002",
"product_identification_helper": {
"cpe": "cpe:2.3:h:welotec:tk500-v2:*:*:*:*:*:*:*:*",
"model_numbers": [
"TK525L-v2",
"TK525L-W-v2",
"TK525W-v2",
"TK535L1-v2"
],
"skus": [
"6912TK525L0N",
"6912TK525LWN",
"6912TK525W0N",
"6912TK535L0N"
]
}
}
},
{
"category": "product_version",
"name": "v1.0.124",
"product": {
"name": "Welotec TK500-v2 firmware v1.0.124",
"product_id": "CSAFPID-12002",
"product_identification_helper": {
"cpe": "cpe:2.3:h:welotec:tk500-v2:1.0.124:*:*:*:*:*:*:*",
"model_numbers": [
"TK525L-v2",
"TK525L-W-v2",
"TK525W-v2",
"TK535L1-v2"
],
"skus": [
"6912TK525L0N",
"6912TK525LWN",
"6912TK525W0N",
"6912TK535L0N"
]
}
}
}
],
"category": "product_name",
"name": "TK500-v2"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:semver/\u003e=0.0.0|\u003c1.0.123",
"product": {
"name": "Welotec TK500-v3 firmware \u003cv1.0.123",
"product_id": "CSAFPID-11003",
"product_identification_helper": {
"cpe": "cpe:2.3:h:welotec:tk500-v3:*:*:*:*:*:*:*:*",
"model_numbers": [
"TK525L-v3",
"TK525L-W-G-v3",
"TK525L-IO-v3",
"TK525L-W-v3",
"TK525W-v3",
"TK555L-v3"
],
"skus": [
"6912TK525L03",
"6912TK525LG3",
"6912TK525LIO",
"6912TK525LW3",
"6912TK525W03",
"6912TK555L03"
]
}
}
},
{
"category": "product_version",
"name": "v1.0.123",
"product": {
"name": "Welotec TK500-v3 firmware v1.0.123",
"product_id": "CSAFPID-12003",
"product_identification_helper": {
"cpe": "cpe:2.3:h:welotec:tk500-v3:1.0.123:*:*:*:*:*:*:*",
"model_numbers": [
"TK525L-v3",
"TK525L-W-G-v3",
"TK525L-IO-v3",
"TK525L-W-v3",
"TK525W-v3",
"TK555L-v3"
],
"skus": [
"6912TK525L03",
"6912TK525LG3",
"6912TK525LIO",
"6912TK525LW3",
"6912TK525W03",
"6912TK555L03"
]
}
}
}
],
"category": "product_name",
"name": "TK500-v3"
}
],
"category": "product_family",
"name": "Industrial Routers"
}
],
"category": "vendor",
"name": "Welotec"
}
],
"product_groups": [
{
"group_id": "CSAFGID-0001",
"product_ids": [
"CSAFPID-11001",
"CSAFPID-11002",
"CSAFPID-11003"
],
"summary": "Affected products."
},
{
"group_id": "CSAFGID-0002",
"product_ids": [
"CSAFPID-12001",
"CSAFPID-12002",
"CSAFPID-12003"
],
"summary": "Fixed products."
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-105978",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"notes": [
{
"category": "description",
"text": "Improper input validation in management control functions may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges.",
"title": "CVE description"
}
],
"product_status": {
"fixed": [
"CSAFPID-12001",
"CSAFPID-12002",
"CSAFPID-12003"
],
"known_affected": [
"CSAFPID-11001",
"CSAFPID-11002",
"CSAFPID-11003"
]
},
"references": [
{
"category": "external",
"summary": "CVSS v4.0 Score: 8.6 / High",
"url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Do not expose the management interface to the internet or other untrusted networks. Restrict management access to trusted administrator workstations using network segmentation and firewall rules.",
"group_ids": [
"CSAFGID-0001"
]
},
{
"category": "vendor_fix",
"details": "Update TK100 to firmware v3.5.116 or later, TK500-v2 to firmware v1.0.124 or later, and TK500-v3 to firmware v1.0.123 or later.",
"group_ids": [
"CSAFGID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.2,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"temporalScore": 7.2,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-11001",
"CSAFPID-11002",
"CSAFPID-11003"
]
}
],
"title": "Command Injection in Management Control Functions"
},
{
"cve": "CVE-2026-105979",
"cwe": {
"id": "CWE-77",
"name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
},
"notes": [
{
"category": "description",
"text": "Improper input validation in the ZeroTier VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.",
"title": "CVE description"
}
],
"product_status": {
"fixed": [
"CSAFPID-12001",
"CSAFPID-12002",
"CSAFPID-12003"
],
"known_affected": [
"CSAFPID-11001",
"CSAFPID-11002",
"CSAFPID-11003"
]
},
"references": [
{
"category": "external",
"summary": "CVSS v4.0 Score: 8.6 / High",
"url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Do not expose the management interface to the internet or other untrusted networks. Restrict management access to trusted administrator workstations using network segmentation and firewall rules. Disable ZeroTier when it is not required and where this is operationally possible.",
"group_ids": [
"CSAFGID-0001"
]
},
{
"category": "vendor_fix",
"details": "Update TK100 to firmware v3.5.116 or later, TK500-v2 to firmware v1.0.124 or later, and TK500-v3 to firmware v1.0.123 or later.",
"group_ids": [
"CSAFGID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.2,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"temporalScore": 7.2,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-11001",
"CSAFPID-11002",
"CSAFPID-11003"
]
}
],
"title": "Command Injection in ZeroTier VPN"
},
{
"cve": "CVE-2026-105980",
"cwe": {
"id": "CWE-77",
"name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
},
"notes": [
{
"category": "description",
"text": "Improper input validation in the WireGuard VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.",
"title": "CVE description"
}
],
"product_status": {
"fixed": [
"CSAFPID-12001",
"CSAFPID-12002",
"CSAFPID-12003"
],
"known_affected": [
"CSAFPID-11001",
"CSAFPID-11002",
"CSAFPID-11003"
]
},
"references": [
{
"category": "external",
"summary": "CVSS v4.0 Score: 8.6 / High",
"url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Do not expose the management interface to the internet or other untrusted networks. Restrict management access to trusted administrator workstations using network segmentation and firewall rules. Disable WireGuard when it is not required and where this is operationally possible.",
"group_ids": [
"CSAFGID-0001"
]
},
{
"category": "vendor_fix",
"details": "Update TK100 to firmware v3.5.116 or later, TK500-v2 to firmware v1.0.124 or later, and TK500-v3 to firmware v1.0.123 or later.",
"group_ids": [
"CSAFGID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.2,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"temporalScore": 7.2,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-11001",
"CSAFPID-11002",
"CSAFPID-11003"
]
}
],
"title": "Command Injection in WireGuard VPN"
},
{
"cve": "CVE-2026-105981",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"notes": [
{
"category": "description",
"text": "Improper input validation in the Digital I/O function may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges.",
"title": "CVE description"
}
],
"product_status": {
"fixed": [
"CSAFPID-12001",
"CSAFPID-12002",
"CSAFPID-12003"
],
"known_affected": [
"CSAFPID-11001",
"CSAFPID-11002",
"CSAFPID-11003"
]
},
"references": [
{
"category": "external",
"summary": "CVSS v4.0 Score: 8.6 / High",
"url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Do not expose the management interface to the internet or other untrusted networks. Restrict management access to trusted administrator workstations using network segmentation and firewall rules. Disable Digital I/O when it is not required and where this is operationally possible.",
"group_ids": [
"CSAFGID-0001"
]
},
{
"category": "vendor_fix",
"details": "Update TK100 to firmware v3.5.116 or later, TK500-v2 to firmware v1.0.124 or later, and TK500-v3 to firmware v1.0.123 or later.",
"group_ids": [
"CSAFGID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.2,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"temporalScore": 7.2,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-11001",
"CSAFPID-11002",
"CSAFPID-11003"
]
}
],
"title": "Command Injection in Digital I/O"
},
{
"cve": "CVE-2026-105982",
"cwe": {
"id": "CWE-77",
"name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
},
"notes": [
{
"category": "description",
"text": "Improper input validation in the IPsec VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.",
"title": "CVE description"
}
],
"product_status": {
"fixed": [
"CSAFPID-12001",
"CSAFPID-12002",
"CSAFPID-12003"
],
"known_affected": [
"CSAFPID-11001",
"CSAFPID-11002",
"CSAFPID-11003"
]
},
"references": [
{
"category": "external",
"summary": "CVSS v4.0 Score: 8.6 / High",
"url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Do not expose the management interface to the internet or other untrusted networks. Restrict management access to trusted administrator workstations using network segmentation and firewall rules. Disable IPsec when it is not required and where this is operationally possible.",
"group_ids": [
"CSAFGID-0001"
]
},
{
"category": "vendor_fix",
"details": "Update TK100 to firmware v3.5.116 or later, TK500-v2 to firmware v1.0.124 or later, and TK500-v3 to firmware v1.0.123 or later.",
"group_ids": [
"CSAFGID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.2,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"temporalScore": 7.2,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-11001",
"CSAFPID-11002",
"CSAFPID-11003"
]
}
],
"title": "Command Injection in IPsec VPN"
},
{
"cve": "CVE-2026-109161",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"notes": [
{
"category": "description",
"text": "Insufficient bounds checking in the Digital I/O function may allow a remote attacker with high privileges to cause a denial of service.",
"title": "CVE description"
}
],
"product_status": {
"fixed": [
"CSAFPID-12001",
"CSAFPID-12002",
"CSAFPID-12003"
],
"known_affected": [
"CSAFPID-11001",
"CSAFPID-11002",
"CSAFPID-11003"
]
},
"references": [
{
"category": "external",
"summary": "CVSS v4.0 Score: 6.9 / Medium",
"url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Do not expose the management interface to the internet or other untrusted networks. Restrict management access to trusted administrator workstations using network segmentation and firewall rules. Disable Digital I/O when it is not required and where this is operationally possible.",
"group_ids": [
"CSAFGID-0001"
]
},
{
"category": "vendor_fix",
"details": "Update TK100 to firmware v3.5.116 or later, TK500-v2 to firmware v1.0.124 or later, and TK500-v3 to firmware v1.0.123 or later.",
"group_ids": [
"CSAFGID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 4.9,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"temporalScore": 4.9,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-11001",
"CSAFPID-11002",
"CSAFPID-11003"
]
}
],
"title": "Buffer Overflow in Digital I/O"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.