Welotec: Two vulnerabilities in TK500v1 router series
view advisory published 2024-04-09
Welotec has closed two vulnerabilities in the TK500v1 router series and advises to update the routers to firmware version r5542 or later. An exploitation of the vulnerabilities can allow an attacker to manipulate the device.
01
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-1083US | —OT elevated | — | ||
An unauthenticated remote attacker who is aware of a MQTT topic name can send and receive messages, including GET/SET configuration commands, reboot commands and firmware updates. | ||||
| CVE-2023-1082US | — | — | ||
An remote attacker with low privileges can perform a command injection which can lead to root access. | ||||
02
references
External citations — patches, advisories, analysis.
03
remediations (2)
- Mitigation
Update the product to firmware v2.3.0.r5542 or later.
- Mitigation
Update the product to firmware v2.3.0.r5542 or later.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan