Welotec TK Routers CVE-2026-105982

Exploitation requires the attacker to already hold high (administrative) privileges on the device and to reach the IPsec VPN configuration function, which processes attacker-controlled input without proper validation. The specific feature is the IPsec VPN functionality of the Welotec TK100, TK500-v2, and TK500-v3 routers; the flaw is only reachable by an authenticated high-privileged principal (PR:H), which is the primary limiting factor. No user interaction is needed (UI:N) and the vector is network-reachable (AV:N), so an authenticated admin session reachable over the network - e.g. an exposed management interface - is sufficient; the specific command-injection trigger syntax is not described in the available sources. Successful exploitation elevates from high-privileged user to root code execution.

This is a genuine but conditional priority rather than a drop-everything emergency. The CVSS 4.0 vector (8.6, AV:N/AC:L/AT:N/PR:H/UI:N) indicates a network-reachable, low-complexity flaw with high confidentiality, integrity and availability impact, but PR:H means the attacker must already hold high privileges on the device, which is the single most important risk-limiting factor. The vuln.today decision label is 'this_week', consistent with a serious issue that is not under active mass exploitation. No KEV listing, no EPSS score, and no PoC are present in the input, so there is no signal of in-the-wild or imminent exploitation - exploitation status is therefore 'no public exploit identified at time of analysis'. The practical danger is privilege escalation to root: an administrative/high-privileged user (or an attacker who has stolen such credentials) can convert account access into full root code execution on the router. SSVC-style reasoning: technical impact is total (root on the device), but exploitation is not automatable in the mass-scanning sense because it is gated behind authentication. Net: prioritize patching for internet-exposed or multi-tenant management scenarios, but the PR:H gate keeps this below the tier of unauthenticated RCE.

An attacker who has obtained high-privileged (administrative) access to a Welotec TK100/TK500 router - via stolen or default credentials, or a malicious insider - submits crafted input to the IPsec VPN configuration function containing shell metacharacters. Because the input is not properly validated (CWE-77), the injected commands are executed by the underlying OS with root privileges, giving the attacker full control of the device. No public PoC or exploit code is referenced in the available data.