{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale",
      "text": "High"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "Multiple vulnerabilities in the web-based management functions of the affected Welotec routers, including VPN-related functions, may allow a remote attacker with high privileges to inject commands or trigger a buffer overflow. Successful exploitation may result in command execution with root privileges or a denial of service.",
        "title": "Summary"
      },
      {
        "category": "details",
        "text": "Successful exploitation of the command injection vulnerabilities may allow an attacker with high privileges to gain complete control of an affected router with root privileges. The attacker could read or modify configuration and data, disrupt network connectivity, install persistent software, or use the router as a foothold for further attacks. Exploitation of the buffer overflow condition may additionally cause the affected service or router to become unavailable.",
        "title": "Impact"
      },
      {
        "category": "details",
        "text": "Do not expose the management interface to the internet or other untrusted networks. Restrict management access to trusted administrator workstations using network segmentation and firewall rules. Disable ZeroTier, WireGuard, IPsec, and Digital I/O functions when they are not required and where this is operationally possible. Monitor affected devices for unexpected configuration changes, processes, user accounts, and outbound network connections.",
        "title": "Mitigation"
      },
      {
        "category": "details",
        "text": "Update the affected products to the following firmware versions or later:\n\n| Product Series / Hardware Revision | Firmware Version |\n|---|---|\n| TK100 | v3.5.116 |\n| TK500-v2 | v1.0.124 |\n| TK500-v3 | v1.0.123 |",
        "title": "Remediation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@welotec.com",
      "name": "Welotec GmbH",
      "namespace": "https://welotec.com"
    },
    "references": [
      {
        "category": "external",
        "summary": "Welotec PSIRT",
        "url": "https://welotec.com/de/pages/coordinated-vulnerability-disclosure-policy"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for Welotec",
        "url": "https://certvde.com/de/advisories/vendor/welotec"
      },
      {
        "category": "self",
        "summary": "VDE-2026-119: Welotec: Multiple vulnerabilities in TK routers - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2026-119"
      },
      {
        "category": "self",
        "summary": "VDE-2026-119: Welotec: Multiple vulnerabilities in TK routers - CSAF",
        "url": "https://welotec.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-119.json"
      }
    ],
    "title": "Welotec: Multiple vulnerabilities in TK routers",
    "tracking": {
      "aliases": [
        "VDE-2026-119"
      ],
      "current_release_date": "2026-11-03T10:00:00.000Z",
      "generator": {
        "date": "2026-10-28T11:15:15.599Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.6.16"
        }
      },
      "id": "VDE-2026-119",
      "initial_release_date": "2026-11-03T10:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-11-03T10:00:00.000Z",
          "number": "1.0.0",
          "summary": "Initial release."
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:semver/>=0.0.0|<3.5.116",
                    "product": {
                      "name": "Welotec TK100 firmware <v3.5.116",
                      "product_id": "CSAFPID-11001",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:h:welotec:tk100:*:*:*:*:*:*:*:*",
                        "model_numbers": [
                          "TK102L",
                          "TK102W"
                        ],
                        "skus": [
                          "6912TK102L00",
                          "6912TK102W00"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "v3.5.116",
                    "product": {
                      "name": "Welotec TK100 firmware v3.5.116",
                      "product_id": "CSAFPID-12001",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:h:welotec:tk100:3.5.116:*:*:*:*:*:*:*",
                        "model_numbers": [
                          "TK102L",
                          "TK102W"
                        ],
                        "skus": [
                          "6912TK102L00",
                          "6912TK102W00"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "TK100"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:semver/>=0.0.0|<1.0.124",
                    "product": {
                      "name": "Welotec TK500-v2 firmware <v1.0.124",
                      "product_id": "CSAFPID-11002",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:h:welotec:tk500-v2:*:*:*:*:*:*:*:*",
                        "model_numbers": [
                          "TK525L-v2",
                          "TK525L-W-v2",
                          "TK525W-v2",
                          "TK535L1-v2"
                        ],
                        "skus": [
                          "6912TK525L0N",
                          "6912TK525LWN",
                          "6912TK525W0N",
                          "6912TK535L0N"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "v1.0.124",
                    "product": {
                      "name": "Welotec TK500-v2 firmware v1.0.124",
                      "product_id": "CSAFPID-12002",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:h:welotec:tk500-v2:1.0.124:*:*:*:*:*:*:*",
                        "model_numbers": [
                          "TK525L-v2",
                          "TK525L-W-v2",
                          "TK525W-v2",
                          "TK535L1-v2"
                        ],
                        "skus": [
                          "6912TK525L0N",
                          "6912TK525LWN",
                          "6912TK525W0N",
                          "6912TK535L0N"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "TK500-v2"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:semver/>=0.0.0|<1.0.123",
                    "product": {
                      "name": "Welotec TK500-v3 firmware <v1.0.123",
                      "product_id": "CSAFPID-11003",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:h:welotec:tk500-v3:*:*:*:*:*:*:*:*",
                        "model_numbers": [
                          "TK525L-v3",
                          "TK525L-W-G-v3",
                          "TK525L-IO-v3",
                          "TK525L-W-v3",
                          "TK525W-v3",
                          "TK555L-v3"
                        ],
                        "skus": [
                          "6912TK525L03",
                          "6912TK525LG3",
                          "6912TK525LIO",
                          "6912TK525LW3",
                          "6912TK525W03",
                          "6912TK555L03"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "v1.0.123",
                    "product": {
                      "name": "Welotec TK500-v3 firmware v1.0.123",
                      "product_id": "CSAFPID-12003",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:h:welotec:tk500-v3:1.0.123:*:*:*:*:*:*:*",
                        "model_numbers": [
                          "TK525L-v3",
                          "TK525L-W-G-v3",
                          "TK525L-IO-v3",
                          "TK525L-W-v3",
                          "TK525W-v3",
                          "TK555L-v3"
                        ],
                        "skus": [
                          "6912TK525L03",
                          "6912TK525LG3",
                          "6912TK525LIO",
                          "6912TK525LW3",
                          "6912TK525W03",
                          "6912TK555L03"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "TK500-v3"
              }
            ],
            "category": "product_family",
            "name": "Industrial Routers"
          }
        ],
        "category": "vendor",
        "name": "Welotec"
      }
    ],
    "product_groups": [
      {
        "group_id": "CSAFGID-0001",
        "product_ids": [
          "CSAFPID-11001",
          "CSAFPID-11002",
          "CSAFPID-11003"
        ],
        "summary": "Affected products."
      },
      {
        "group_id": "CSAFGID-0002",
        "product_ids": [
          "CSAFPID-12001",
          "CSAFPID-12002",
          "CSAFPID-12003"
        ],
        "summary": "Fixed products."
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-105978",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
      },
      "notes": [
        {
          "category": "description",
          "text": "Improper input validation in management control functions may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-12001",
          "CSAFPID-12002",
          "CSAFPID-12003"
        ],
        "known_affected": [
          "CSAFPID-11001",
          "CSAFPID-11002",
          "CSAFPID-11003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVSS v4.0 Score: 8.6 / High",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Do not expose the management interface to the internet or other untrusted networks. Restrict management access to trusted administrator workstations using network segmentation and firewall rules.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update TK100 to firmware v3.5.116 or later, TK500-v2 to firmware v1.0.124 or later, and TK500-v3 to firmware v1.0.123 or later.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.2,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "temporalScore": 7.2,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-11001",
            "CSAFPID-11002",
            "CSAFPID-11003"
          ]
        }
      ],
      "title": "Command Injection in Management Control Functions"
    },
    {
      "cve": "CVE-2026-105979",
      "cwe": {
        "id": "CWE-77",
        "name": "Improper Neutralization of Special Elements used in a Command ('Command Injection')"
      },
      "notes": [
        {
          "category": "description",
          "text": "Improper input validation in the ZeroTier VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-12001",
          "CSAFPID-12002",
          "CSAFPID-12003"
        ],
        "known_affected": [
          "CSAFPID-11001",
          "CSAFPID-11002",
          "CSAFPID-11003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVSS v4.0 Score: 8.6 / High",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Do not expose the management interface to the internet or other untrusted networks. Restrict management access to trusted administrator workstations using network segmentation and firewall rules. Disable ZeroTier when it is not required and where this is operationally possible.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update TK100 to firmware v3.5.116 or later, TK500-v2 to firmware v1.0.124 or later, and TK500-v3 to firmware v1.0.123 or later.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.2,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "temporalScore": 7.2,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-11001",
            "CSAFPID-11002",
            "CSAFPID-11003"
          ]
        }
      ],
      "title": "Command Injection in ZeroTier VPN"
    },
    {
      "cve": "CVE-2026-105980",
      "cwe": {
        "id": "CWE-77",
        "name": "Improper Neutralization of Special Elements used in a Command ('Command Injection')"
      },
      "notes": [
        {
          "category": "description",
          "text": "Improper input validation in the WireGuard VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-12001",
          "CSAFPID-12002",
          "CSAFPID-12003"
        ],
        "known_affected": [
          "CSAFPID-11001",
          "CSAFPID-11002",
          "CSAFPID-11003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVSS v4.0 Score: 8.6 / High",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Do not expose the management interface to the internet or other untrusted networks. Restrict management access to trusted administrator workstations using network segmentation and firewall rules. Disable WireGuard when it is not required and where this is operationally possible.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update TK100 to firmware v3.5.116 or later, TK500-v2 to firmware v1.0.124 or later, and TK500-v3 to firmware v1.0.123 or later.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.2,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "temporalScore": 7.2,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-11001",
            "CSAFPID-11002",
            "CSAFPID-11003"
          ]
        }
      ],
      "title": "Command Injection in WireGuard VPN"
    },
    {
      "cve": "CVE-2026-105981",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
      },
      "notes": [
        {
          "category": "description",
          "text": "Improper input validation in the Digital I/O function may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-12001",
          "CSAFPID-12002",
          "CSAFPID-12003"
        ],
        "known_affected": [
          "CSAFPID-11001",
          "CSAFPID-11002",
          "CSAFPID-11003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVSS v4.0 Score: 8.6 / High",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Do not expose the management interface to the internet or other untrusted networks. Restrict management access to trusted administrator workstations using network segmentation and firewall rules. Disable Digital I/O when it is not required and where this is operationally possible.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update TK100 to firmware v3.5.116 or later, TK500-v2 to firmware v1.0.124 or later, and TK500-v3 to firmware v1.0.123 or later.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.2,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "temporalScore": 7.2,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-11001",
            "CSAFPID-11002",
            "CSAFPID-11003"
          ]
        }
      ],
      "title": "Command Injection in Digital I/O"
    },
    {
      "cve": "CVE-2026-105982",
      "cwe": {
        "id": "CWE-77",
        "name": "Improper Neutralization of Special Elements used in a Command ('Command Injection')"
      },
      "notes": [
        {
          "category": "description",
          "text": "Improper input validation in the IPsec VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-12001",
          "CSAFPID-12002",
          "CSAFPID-12003"
        ],
        "known_affected": [
          "CSAFPID-11001",
          "CSAFPID-11002",
          "CSAFPID-11003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVSS v4.0 Score: 8.6 / High",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Do not expose the management interface to the internet or other untrusted networks. Restrict management access to trusted administrator workstations using network segmentation and firewall rules. Disable IPsec when it is not required and where this is operationally possible.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update TK100 to firmware v3.5.116 or later, TK500-v2 to firmware v1.0.124 or later, and TK500-v3 to firmware v1.0.123 or later.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.2,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "temporalScore": 7.2,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-11001",
            "CSAFPID-11002",
            "CSAFPID-11003"
          ]
        }
      ],
      "title": "Command Injection in IPsec VPN"
    },
    {
      "cve": "CVE-2026-109161",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"
      },
      "notes": [
        {
          "category": "description",
          "text": "Insufficient bounds checking in the Digital I/O function may allow a remote attacker with high privileges to cause a denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-12001",
          "CSAFPID-12002",
          "CSAFPID-12003"
        ],
        "known_affected": [
          "CSAFPID-11001",
          "CSAFPID-11002",
          "CSAFPID-11003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVSS v4.0 Score: 6.9 / Medium",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Do not expose the management interface to the internet or other untrusted networks. Restrict management access to trusted administrator workstations using network segmentation and firewall rules. Disable Digital I/O when it is not required and where this is operationally possible.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update TK100 to firmware v3.5.116 or later, TK500-v2 to firmware v1.0.124 or later, and TK500-v3 to firmware v1.0.123 or later.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 4.9,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "temporalScore": 4.9,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-11001",
            "CSAFPID-11002",
            "CSAFPID-11003"
          ]
        }
      ],
      "title": "Buffer Overflow in Digital I/O"
    }
  ]
}