Skip to content
OpenAdvisories
Critical VDE-2024-009 2 CVEs

Welotec: Two vulnerabilities in TK500v1 router series

Published Apr 9, 2024 · Updated May 14, 2025 · Revision 4

Vendor: Welotec Product: TK515L Product: TK515L Set Product: TK515L-W Product: TK515L-W Set Product: TK525L Product: TK525L Set Product: TK525L-W Product: TK525L-W Set Product: TK525U Product: TK525U Set Product: TK525W Product: TK525W Set Product: TK535L1 Product: TK535L1 Set

Summary

Welotec has closed two vulnerabilities in the TK500v1 router series and advises to update the routers to firmware version r5542 or later. An exploitation of the vulnerabilities can allow an attacker to manipulate the device.

Details

Update the product to firmware v2.3.0.r5542 or later.

Vulnerabilities 2

  • Critical 9.8
    CVE-2023-1083

    Welotec: improper access control in TK500v1 router series

    An unauthenticated remote attacker who is aware of a MQTT topic name can send and receive messages, including GET/SET configuration commands, reboot commands and firmware updates.

    Welotec TK525L-W Set TK515L TK525U Set
  • High 8.8
    CVE-2023-1082

    Welotec: Command injection vulnerability in TK500v1 router series

    An remote attacker with low privileges can perform a command injection which can lead to root access.

    Welotec TK535L1 Set TK525L-W TK525U

Revision history

  1. #4

    Fix: firmware category, added distribution, version space

  2. #3

    Fix: correct certvde domain, added self-reference

  3. #2

    Minor typo changes. Reorder Products and Branches. Duplicate remediation from document notes to the vulnerabilities.

  4. #1

    initial revision

References