Vulnerability · Published Nov 3, 2026 · Assigned by CERTVDE

CVE-2026-105978Command Injection in Management Control Functions

High 7.2

In plain English

A high-severity OS command injection in TK100 from Welotec. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.4%top 70.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper input validation in management control functions may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges.

Affected products (as reported)

Vendor	Product	Versions
Welotec	TK100	0.0.0 – before 3.5.116
Welotec	TK500-v2	0.0.0 – before 1.0.124
Welotec	TK500-v3	0.0.0 – before 1.0.123

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://www.certvde.com/en/advisories/VDE-2026-119/