Remote Command Injection Vulnerability in ZeroTier VPN by ZeroTier Inc.
CVE-2026-105979

8.6HIGH

Key Information:

Vendor

Welotec

Status
Tk100
Tk500-v2
Tk500-v3
Vendor
CVE Published:
3 November 2026

What is CVE-2026-105979?

A critical vulnerability has been identified in ZeroTier VPN due to improper input validation. This flaw enables a remote attacker with elevated privileges to inject and execute system commands, potentially compromising the system's integrity. Administrators are urged to review their ZeroTier configurations and apply necessary patches to mitigate risks associated with unauthorized command execution.

Affected Version(s)

TK100 0.0.0 < 3.5.116

TK500-v2 0.0.0 < 1.0.124

TK500-v3 0.0.0 < 1.0.123

References

https://www.certvde.com/en/advisories/VDE-2026-119/

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.