Welotec TK Series CVE-2026-105980

Exploitation requires that the attacker already hold high-privileged (administrative) access to the device's management function (PR:H) and that the WireGuard VPN configuration feature on a Welotec TK100, TK500-v2, or TK500-v3 router be reachable and in use. The attacker then supplies improperly validated input to that WireGuard function to achieve OS command injection (CWE-77) executing as root. No user interaction is required (UI:N) and the vector is network-reachable (AV:N). The principal limiting factors are the high-privilege authentication prerequisite - this is not a pre-auth or low-privilege flaw - and the niche, industry-specific deployment of these industrial routers; the available sources do not state whether the WireGuard feature is enabled by default or the exact input field involved.

The CVSS 4.0 signals (8.6, High) describe a network-reachable flaw (AV:N/AC:L/AT:N) that nonetheless requires high privileges (PR:H) and no user interaction, with full impact on the vulnerable device (VC:H/VI:H/VA:H) but no scope change (SC:N/SI:N/SA:N). The PR:H requirement is the single most important mitigating factor: an attacker must already hold high-privileged (administrative) access to the device before command injection to root is possible, which substantially narrows the realistic threat to insiders, credential-compromise scenarios, or chained attacks. The vuln.today decision label is 'this_week' rather than act_now/emergency, consistent with a serious-but-not-critical priority. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no evidence of active or widespread exploitation - the sole reference is the CERT@VDE vendor advisory VDE-2026-119, not a proof-of-concept. Net assessment: a genuine privilege-escalation-to-root issue worth patching on a near-term schedule, but the high-privilege prerequisite and niche industrial-router footprint make mass opportunistic exploitation unlikely; prioritize based on exposure of device management interfaces.

An attacker who already possesses high-privileged (administrative) access to a Welotec TK100/TK500 router's management function supplies maliciously crafted input to the WireGuard VPN configuration feature, which fails to validate it properly and passes it to a system shell. The injected commands then execute with root privileges, giving full control of the device. No public exploit code or proof-of-concept was identified at time of analysis.