attack vector is network; attack complexity is low; privileges required is high; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products
Welotec TK100, Welotec TK500-v2, and Welotec TK500-v3
Classified as
CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Welotec
TK100
Welotec
TK500-v2
Welotec
TK500-v3
Subsystems
General OT
Sectors
Multiple
What to Know
Improper input validation in the Digital I/O function may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges.
What to Do
Monitor Welotec's web page for any future patch releases.