Remote Command Injection in Management Control Functions of Affected Vendor's Product
CVE-2026-105978

8.6HIGH

Key Information:

Vendor

Welotec

Status
Tk100
Tk500-v2
Tk500-v3
Vendor
CVE Published:
3 November 2026

What is CVE-2026-105978?

The vulnerability arises from inadequate input validation mechanisms within the management control functions of the affected software, allowing an attacker with elevated privileges to inject and execute arbitrary operating system commands. This poses significant risks as it could lead to unauthorized access and control over system resources.

Affected Version(s)

TK100 0.0.0 < 3.5.116

TK500-v2 0.0.0 < 1.0.124

TK500-v3 0.0.0 < 1.0.123

References

https://www.certvde.com/en/advisories/VDE-2026-119/

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.