Riskcovery

CVE-2023-1082

Welotec: Command injection vulnerability in TK500v1 router series

State
Published
Severity
8.8 High
Published
Apr 9, 2024
Updated
Aug 21, 2024
Reserved
Feb 28, 2023

Read the record on cve.org

Description

An remote attacker with low privileges can perform a command injection which can lead to root access.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCERTVDE

Weaknesses

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

ProductVersions
TK515LWelotec
  • before v2.3.0.r5542Affected
TK515L SetWelotec
  • before v2.3.0.r5542Affected
TK515L-WWelotec
  • before v2.3.0.r5542Affected
TK515L-W SetWelotec
  • before v2.3.0.r5542Affected
TK525LWelotec
  • before v2.3.0.r5542Affected
TK525L SetWelotec
  • before v2.3.0.r5542Affected
TK525L-WWelotec
  • before v2.3.0.r5542Affected
TK525L-W SetWelotec
  • before v2.3.0.r5542Affected
TK525UWelotec
  • before v2.3.0.r5542Affected
TK525U SetWelotec
  • before v2.3.0.r5542Affected
TK525WWelotec
  • before v2.3.0.r5542Affected
TK525W SetWelotec
  • before v2.3.0.r5542Affected
TK535L1Welotec
  • before v2.3.0.r5542Affected
TK535L1 SetWelotec
  • before v2.3.0.r5542Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.