Skip to content
OpenAdvisories

Vendor

Welotec

11 known vulnerabilities.

Products

TK100 6 TK500-v2 6 TK500-v3 6 TK515L 2 TK515L Set 2 TK515L-W 2 TK515L-W Set 2 TK525L 2 TK525L Set 2 TK525L-W 2 TK525L-W Set 2 TK525U 2 TK525U Set 2 TK525W 2 TK525W Set 2 TK535L1 2 TK535L1 Set 2 SmartEMS Web Application 1 SMART EMS 1 VPN Security Suite 1 EG400Mk2-D11001-000101 1 EG400Mk2-D11101-000101 1 EG503W 1 EG503L 1 EG503W_4GB 1 EG503L_4GB 1 EG503L-G 1 EG500Mk2-A11101-000101 1 EG500Mk2-A11001-000101 1 EG500Mk2-B11101-000101 1 EG500Mk2-B11001-000101 1 EG500Mk2-C11101-000101 1 EG500Mk2-C11001-000101 1 EG500Mk2-A12011-000101 1 EG500Mk2-A11001-000201 1 EG500Mk2-A21101-000101 1 EG602W 1 EG602L 1 EG603W Mk2 1 EG603L Mk2 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2025-41702

    egOS WebGUI Hard-Coded JWT Secret Enables Authentication Bypass

    The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key.

    Welotec EG500Mk2-A12011-000101 EG503L-G EG802W_i7_512GB_DinRail
  • Critical 9.8
    CVE-2023-1083

    Welotec: improper access control in TK500v1 router series

    An unauthenticated remote attacker who is aware of a MQTT topic name can send and receive messages, including GET/SET configuration commands, reboot commands and firmware updates.

    Welotec TK515L-W Set TK535L1 TK525L Set