Vulnerability · Published Nov 3, 2026 · Assigned by CERTVDE

CVE-2026-105979Command Injection in ZeroTier VPN

High 7.2

In plain English

A high-severity command injection in TK100 from Welotec. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.4%top 70.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Improper input validation in the ZeroTier VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.

Affected products (as reported)

Vendor	Product	Versions
Welotec	TK100	0.0.0 – before 3.5.116
Welotec	TK500-v2	0.0.0 – before 1.0.124
Welotec	TK500-v3	0.0.0 – before 1.0.123

Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://www.certvde.com/en/advisories/VDE-2026-119/