Welotec TK Series CVE-2026-105978

Exploitation requires the attacker to first hold high-privilege (administrative) access to the device's management control functions - per CVSS PR:H, this is an authenticated-admin prerequisite, not an open path. Given that gate, exploitation is network-reachable (AV:N), needs no user interaction (UI:N), low attack complexity (AC:L), and no special timing/attack requirement (AT:N) against the management plane of Welotec TK100, TK500-v2, and TK500-v3 routers. The primary limiting factor is the admin-authentication requirement; exposure is further bounded by whether the management interface is reachable from untrusted networks. The exact vulnerable management function, protocol, and any version/firmware conditions are not specified in the available description - consult CERT@VDE advisory VDE-2026-119 for affected versions and fixed firmware.

The CVSS 4.0 signals (AV:N/AC:L/AT:N/PR:H/UI:N, impacts VC:H/VI:H/VA:H) describe a network-reachable, low-complexity command-injection flaw that nonetheless requires high privileges (PR:H) to reach the affected management control functions. This is the single most important modifier: the attacker must already be an authenticated administrator of the device's management interface, which sharply narrows the realistic attacker population and downgrades this from a 'spray-and-pray' internet exploit to a privilege-escalation / lateral-movement concern (admin on the web/management plane gains root on the underlying OS). No EPSS score was supplied, the CVE is NOT in CISA KEV, and no proof-of-concept or exploit reference is present in the input - only the CERT@VDE vendor advisory. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a serious but not actively-exploited issue. Bottom line: a genuine integrity/availability risk on OT/industrial router gear where any admin compromise becomes full root control, but the PR:H gate means it is not a mass-exploitable, unauthenticated internet threat - prioritize patching for internet- or OT-exposed management interfaces while recognizing exploitation presupposes admin access.

An attacker who has obtained administrative credentials to the Welotec router's management interface (e.g., via phishing, default/reused credentials, or an upstream compromise) submits crafted input to a management control function that fails to validate it, smuggling OS commands into a system call. Those commands execute as root, giving the attacker full control of the device's operating system. No public exploit code or PoC reference is present in the supplied data.