Live › vulnerability › CVE-2026-105981
Improper input validation in the Digital I/O function lets a remote attacker with high privileges inject operating system commands. The injected commands run with root privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 09:19 UTC. All times on this page are UTC.
Welotec TK100, TK500-v2 and TK500-v3 series routers on firmware older than 3.5.116, 1.0.124 and 1.0.123 respectively, per CERT@VDE VDE-2026-119. Exploitation needs network access to the web management interface and a high-privilege (admin) account; commands then run as root. Teams without these routers, or whose management interface is not reachable by untrusted users, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| TK100 | vendor | < 3.5.116 | – |
| TK500-v2 | vendor | < 1.0.124 | – |
| TK500-v3 | vendor | < 1.0.123 | – |
3.5.116; TK500-v2 (TK525L-v2, TK525L-W-v2, TK525W-v2, TK535L1-v2) below 1.0.124; TK500-v3 (TK525L-v3, TK525L-W-G-v3, TK525L-IO-v3, TK525L-W-v3, TK525W-v3, TK555L-v3) below 1.0.123Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper input validation in the Digital I/O function may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges.
This page as .md · .json · in your agent: get_signal("CVE-2026-105981")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.