Patch Ticker

Welotec TK-series device management command injection flaw

Anyone with admin rights can take over Welotec devices.

Summary

Improper input validation in the management functions of Welotec TK100, TK500-v2 and TK500-v3 devices lets a remote attacker with high privileges run operating system commands. The commands run with root privileges.

Affected when

  • remote attacker with high privileges

What to do

Update TK100 to 3.5.116, TK500-v2 to 1.0.124, and TK500-v3 to 1.0.123 or later.

Update to at least the version for your product:

  • Welotec TK100 3.5.116 or later
  • Welotec TK500-v2 1.0.124 or later
  • Welotec TK500-v3 1.0.123 or later

Update these devices now.

  • Welotec TK100
  • Welotec TK500-v2
  • Welotec TK500-v3

Fixed in version 3.5.116.

Products and platforms

  • Welotec TK100
  • Welotec TK500-v2
  • Welotec TK500-v3

CVE IDs

Sources

Times

First published

First seen