attack vector is network; attack complexity is low; privileges required is high; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products
Welotec TK100, Welotec TK500-v2, and Welotec TK500-v3
Classified as
CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Welotec
TK100
Welotec
TK500-v2
Welotec
TK500-v3
Subsystems
General OT
Sectors
Multiple
What to Know
Improper input validation in the IPsec VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.
What to Do
Monitor Welotec's web page for any future patch releases.