Vulnerability · Published Apr 9, 2024 · Assigned by CERTVDE
CVE-2023-1082Welotec: Command injection vulnerability in TK500v1 router series
High 8.8
In plain English
A high-severity OS command injection in TK515L from Welotec. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.0%top 37.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An remote attacker with low privileges can perform a command injection which can lead to root access.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Welotec | TK515L | 0 – before v2.3.0.r5542 |
| Welotec | TK515L Set | 0 – before v2.3.0.r5542 |
| Welotec | TK515L-W | 0 – before v2.3.0.r5542 |
| Welotec | TK515L-W Set | 0 – before v2.3.0.r5542 |
| Welotec | TK525L | 0 – before v2.3.0.r5542 |
| Welotec | TK525L Set | 0 – before v2.3.0.r5542 |
| Welotec | TK525L-W | 0 – before v2.3.0.r5542 |
| Welotec | TK525L-W Set | 0 – before v2.3.0.r5542 |
| Welotec | TK525U | 0 – before v2.3.0.r5542 |
| Welotec | TK525U Set | 0 – before v2.3.0.r5542 |
| Welotec | TK525W | 0 – before v2.3.0.r5542 |
| Welotec | TK525W Set | 0 – before v2.3.0.r5542 |
| Welotec | TK535L1 | 0 – before v2.3.0.r5542 |
| Welotec | TK535L1 Set | 0 – before v2.3.0.r5542 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H