Welotec TK Series EUVD-2026-115709

Exploitation requires an attacker to already hold high privileges (administrative-level authentication, per CVSS PR:H) on the Welotec TK100 or TK500-v2/v3 device, and requires access to the device's ZeroTier VPN function, which performs improper input validation (CWE-77) on attacker-supplied input that is then passed to a system command. The vulnerable function is reachable over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). The principal limiting factor is the high-privilege authentication requirement, which prevents anonymous/low-privilege or purely external exploitation; the ZeroTier VPN feature must also be present/usable on the deployed device. The specific input, parameter, and configuration state that trigger the injection are not described in the available sources.

The CVSS 4.0 base score is 8.6 (High) with vector AV:N/AC:L/AT:N/PR:H/UI:N and full high impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H), subsequent-system impact none. The single most important mitigating signal is PR:H: exploitation requires an attacker who already holds high privileges on the Welotec TK100/TK500 device, so this is a privilege-to-root command-injection issue rather than a pre-auth internet-facing takeover. The vuln.today decision label is this_week, indicating elevated but not emergency urgency. No EPSS score, no CISA KEV listing, and no PoC/exploit reference are present in the supplied data, so there is no evidence of active exploitation or public exploit code. The net picture is a genuine high-severity flaw (unauthenticated-network reachability of the function combined with root code execution) whose real-world risk is tempered by the high-privilege prerequisite; it is a priority for operators of these industrial routers but, absent EPSS/KEV/PoC signals, there is no indication of widespread or imminent mass exploitation. Note a tension worth verifying: AV:N plus PR:H means the attacker reaches the vulnerable VPN function over the network but must already be authenticated at a high privilege level - confirm with the CERT@VDE advisory what account/role 'high privileges' denotes on these devices.

An attacker who has obtained high-privilege (administrative) access to a Welotec TK100 or TK500 device supplies crafted input to the ZeroTier VPN configuration function, which fails to validate it; the input is passed into a system command and executed. Because the injected command runs with root privileges, the attacker gains full control of the device operating system. No public exploit was identified in the available data, and the low attack complexity (AC:L) means the injection is straightforward once the privileged access exists.