Skip to content
OpenAdvisories
High · 8.8 CVE-2023-1082 EUVD-2023-23369GHSA-3gw6-fj56-vc35

Welotec: Command injection vulnerability in TK500v1 router series

Published Apr 9, 2024 · Updated Aug 21, 2024 · Assigned by CERTVDE

Vendor: Welotec Product: TK515L Product: TK515L Set Product: TK515L-W Product: TK515L-W Set Product: TK525L Product: TK525L Set Product: TK525L-W Product: TK525L-W Set Product: TK525U Product: TK525U Set Product: TK525W Product: TK525W Set Product: TK535L1 Product: TK535L1 Set

Description

An remote attacker with low privileges can perform a command injection which can lead to root access.

Affected products

VendorProductAffectedFixed
Welotec TK515L < v2.3.0.r5542 v2.3.0.r5542
Welotec TK515L Set < v2.3.0.r5542 v2.3.0.r5542
Welotec TK515L-W < v2.3.0.r5542 v2.3.0.r5542
Welotec TK515L-W Set < v2.3.0.r5542 v2.3.0.r5542
Welotec TK525L < v2.3.0.r5542 v2.3.0.r5542
Welotec TK525L Set < v2.3.0.r5542 v2.3.0.r5542
Welotec TK525L-W < v2.3.0.r5542 v2.3.0.r5542
Welotec TK525L-W Set < v2.3.0.r5542 v2.3.0.r5542
Welotec TK525U < v2.3.0.r5542 v2.3.0.r5542
Welotec TK525U Set < v2.3.0.r5542 v2.3.0.r5542
Welotec TK525W < v2.3.0.r5542 v2.3.0.r5542
Welotec TK525W Set < v2.3.0.r5542 v2.3.0.r5542
Welotec TK535L1 < v2.3.0.r5542 v2.3.0.r5542
Welotec TK535L1 Set < v2.3.0.r5542 v2.3.0.r5542

Advisories 1

References