Welotec TK Gateways CVE-2026-105981

Exploitation requires network reachability to the device's management/configuration interface AND valid high-privilege credentials (PR:H) - the attacker must be an authenticated administrative or operator-level user able to invoke the Digital I/O function. The trigger is unvalidated input to that Digital I/O function which is passed into an OS command (CWE-78). What LIMITS exploitation: the mandatory high-privilege authentication (no anonymous/unauthenticated path per PR:H), and applicability only to Welotec TK100, TK500-v2, and TK500-v3 gateways. No user interaction is required (UI:N). The exact configuration parameter and whether non-default settings are needed are not described in the available sources.

This is a genuine but access-gated risk rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, score 8.6) and the description agree: exploitation is remote and low-complexity, but requires high privileges (PR:H), meaning the attacker must already be an authenticated administrative/operator-level user on the device. Technical impact is total - command injection yielding root (VC:H/VI:H/VA:H). The vuln.today decision label is 'this_week', consistent with a serious flaw that is not under active mass exploitation. No EPSS score, no CISA KEV listing, and no proof-of-concept are present in the input, so there is no signal of current exploitation; exploitation status is therefore 'no public exploit identified at time of analysis.' The signals are internally consistent (network vector, authenticated, full impact) with no contradiction to flag. The main caveat is the PR:H gate: real-world risk hinges on how well administrative credentials to these industrial gateways are protected, since a single compromised or default/weak admin credential converts this into reliable root code execution.

An attacker who has obtained high-privilege (administrative/operator) access to a Welotec TK100/TK500 gateway - for example via reused, weak, or phished management credentials - reaches the Digital I/O configuration function over the network and supplies crafted input that is not properly validated. Because the input is passed to an OS command, the attacker injects additional commands that execute with root privileges, achieving full device takeover. No public exploit code is identified at the time of analysis, and the specific injectable parameter is not detailed in the available sources.