Welotec: Two vulnerabilities in TK500v1 router series
Advisory ansehen veröffentlicht 2024-04-09
Welotec has closed two vulnerabilities in the TK500v1 router series and advises to update the routers to firmware version r5542 or later. An exploitation of the vulnerabilities can allow an attacker to manipulate the device.
01
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-1083US | —OT erhöht | — | ||
An unauthenticated remote attacker who is aware of a MQTT topic name can send and receive messages, including GET/SET configuration commands, reboot commands and firmware updates. | ||||
| CVE-2023-1082US | — | — | ||
An remote attacker with low privileges can perform a command injection which can lead to root access. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
03
Behebungen (2)
- Mitigation
Update the product to firmware v2.3.0.r5542 or later.
- Mitigation
Update the product to firmware v2.3.0.r5542 or later.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan