Riskcovery

CVE-2023-1083

Welotec: improper access control in TK500v1 router series

State
Published
Severity
9.8 Critical
Published
Apr 9, 2024
Updated
Oct 2, 2024
Reserved
Feb 28, 2023

Read the record on cve.org

Description

An unauthenticated remote attacker who is aware of a MQTT topic name can send and receive messages, including GET/SET configuration commands, reboot commands and firmware updates.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCERTVDE

Weaknesses

  • CWE-306 Missing Authentication for Critical Function

Affected Products

ProductVersions
TK515LWelotec
  • before v2.3.0.r5542Affected
TK515L SetWelotec
  • before v2.3.0.r5542Affected
TK515L-WWelotec
  • before v2.3.0.r5542Affected
TK515L-W SetWelotec
  • before v2.3.0.r5542Affected
TK525LWelotec
  • before v2.3.0.r5542Affected
TK525L SetWelotec
  • before v2.3.0.r5542Affected
TK525L-WWelotec
  • before v2.3.0.r5542Affected
TK525L-W SetWelotec
  • before v2.3.0.r5542Affected
TK525UWelotec
  • before v2.3.0.r5542Affected
TK525U SetWelotec
  • before v2.3.0.r5542Affected
TK525WWelotec
  • before v2.3.0.r5542Affected
TK525W SetWelotec
  • before v2.3.0.r5542Affected
TK535L1Welotec
  • before v2.3.0.r5542Affected
TK535L1 SetWelotec
  • before v2.3.0.r5542Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.