{"id":"CVE-2026-105981","kind":"vulnerability","aliases":["CVE-2026-105981"],"related":[],"title":"Welotec TK100, TK500-v2 and TK500-v3 routers: Digital I/O command injection gives root to an admin","description":"Improper input validation in the Digital I/O function may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges.","summary":"Improper input validation in the Digital I/O function lets a remote attacker with high privileges inject operating system commands. The injected commands run with root privileges.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TK100","fixed":[],"affected":"< 3.5.116","ecosystem":"vendor"},{"name":"TK500-v2","fixed":[],"affected":"< 1.0.124","ecosystem":"vendor"},{"name":"TK500-v3","fixed":[],"affected":"< 1.0.123","ecosystem":"vendor"}],"ecosystems":[],"tags":["command-injection","digital-io","industrial","infrastructure","router","tk100","tk500","welotec"],"not_affected_if":["auth-required"],"how_to_check":"Check the firmware version in the router's web interface. Affected: TK100 (TK102L, TK102W) below 3.5.116; TK500-v2 (TK525L-v2, TK525L-W-v2, TK525W-v2, TK535L1-v2) below 1.0.124; TK500-v3 (TK525L-v3, TK525L-W-G-v3, TK525L-IO-v3, TK525L-W-v3, TK525W-v3, TK555L-v3) below 1.0.123. Also restrict who can reach the web management interface.","fix":null,"status":"open","published_at":"2026-11-03T09:17:10+00:00","first_seen_at":"2026-11-03T09:19:50+00:00","triaged_at":"2026-11-03T09:20:11+00:00","updated_at":"2026-11-03T09:21:12+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-03T09:20:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Digital I/O function lets a remote privileged user run root OS commands","impact":"high","summary":"Improper input validation in the Digital I/O function lets a remote attacker with high privileges inject operating system commands. The injected commands run with root privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["digital-io"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs operating system commands as root on the device","analyst_note":"Identify the affected product and vendor advisory from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-105981); no product or fixed version is given in the sources.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources do not name the affected product or firmware version, so the exposed systems cannot be identified from them. Look for devices that expose a Digital I/O function over the network. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000608,"input_tokens":4067,"output_tokens":402,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product and vendor advisory from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-105981); no product or fixed version is given in the sources.","search":"'-105981':22A,25A '-2026':21A,24A 'admin':19A 'allow':80C 'attack':56B,83C 'command':13A,34B,63B,66B,91C 'command-inject':33B 'cve':20A,23A 'digit':11A,37B,50B,76C 'digital-io':36B 'execut':93C 'function':52B,78C 'give':15A 'high':58B,85C 'i/o':12A,51B,77C 'improp':45B,71C 'industri':39B 'infrastructur':40B 'inject':14A,35B,60B,65B,88C 'input':46B,72C 'io':38B 'let':53B 'may':79C 'oper':61B,89C 'privileg':59B,70B,86C,97C 'remot':55B,82C 'root':16A,69B,96C 'router':10A,41B 'run':67B 'system':62B,90C 'tk100':2A,26A,42B 'tk500':4A,8A,28A,31A,43B 'tk500-v2':3A,27A 'tk500-v3':7A,30A 'v2':5A,29A 'v3':9A,32A 'valid':47B,73C 'welotec':1A,44B","nicknames":[],"mitigations":[],"who_affected":"Welotec TK100, TK500-v2 and TK500-v3 series routers on firmware older than 3.5.116, 1.0.124 and 1.0.123 respectively, per CERT@VDE VDE-2026-119. Exploitation needs network access to the web management interface and a high-privilege (admin) account; commands then run as root. Teams without these routers, or whose management interface is not reachable by untrusted users, can skip it.","tier":"B","verified":{"products":{"at":"2026-11-03T09:21:12Z","by":"analyst","doc":"https://www.certvde.com/en/advisories/VDE-2026-119/","run_id":1474},"who_affected":{"at":"2026-11-03T09:21:12Z","by":"analyst","doc":"https://www.certvde.com/en/advisories/VDE-2026-119/","run_id":1474}},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["tk100","tk500v2","tk500v3"],"ptokens":["tk100","tk500","v2","v3"],"labels":["commandinjection","digitalio","high","industrial","infrastructure","router","tk100","tk500","welotec"],"first_public_at":"2026-11-03T09:17:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"info@cert.vde.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105981","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105981","severity":null,"published_at":"2026-11-03T09:17:10+00:00","modified_at":"2026-11-03T09:17:10+00:00","first_seen_at":"2026-11-03T09:19:50+00:00","fetched_at":"2026-11-03T09:19:50+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-105981:1474","url":null,"severity":null,"published_at":"2026-11-03T09:21:12+00:00","modified_at":"2026-11-03T09:21:12+00:00","first_seen_at":"2026-11-03T09:21:12+00:00","fetched_at":"2026-11-03T09:21:12+00:00","note":"Found CERT@VDE advisory VDE-2026-119 (Welotec TK routers); affected ranges from advisory. Advisory has no remediation section, so fixed versions are not stated (