Insufficient Bounds Checking in Digital I/O Function Affects Vendor Product
CVE-2026-109161

6.9MEDIUM

Key Information:

Vendor

Welotec

Status
Tk100
Tk500-v2
Tk500-v3
Vendor
CVE Published:
3 November 2026

What is CVE-2026-109161?

An insufficient bounds checking vulnerability in the Digital I/O function may allow an attacker with elevated privileges to exploit the flaw, resulting in a potential denial of service. This can lead to disruptions in service availability and could be leveraged for further attacks. Organizations using this product should assess their security posture and implement necessary mitigations as detailed in the advisory.

Affected Version(s)

TK100 0.0.0 < 3.5.116

TK500-v2 0.0.0 < 1.0.124

TK500-v3 0.0.0 < 1.0.123

References

https://www.certvde.com/en/advisories/VDE-2026-119/

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.