Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2023-1083

Welotec: improper access control in TK500v1 router series

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERTVDE

Description

An unauthenticated remote attacker who is aware of a MQTT topic name can send and receive messages, including GET/SET configuration commands, reboot commands and firmware updates.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Welotec TK515L

Default version status: unaffected

  • 0 to < v2.3.0.r5542affected

Welotec TK515L Set

Default version status: unaffected

  • 0 to < v2.3.0.r5542affected

Welotec TK515L-W

Default version status: unaffected

  • 0 to < v2.3.0.r5542affected

Welotec TK515L-W Set

Default version status: unaffected

  • 0 to < v2.3.0.r5542affected

Welotec TK525L

Default version status: unaffected

  • 0 to < v2.3.0.r5542affected

Welotec TK525L Set

Default version status: unaffected

  • 0 to < v2.3.0.r5542affected

Welotec TK525L-W

Default version status: unaffected

  • 0 to < v2.3.0.r5542affected

Welotec TK525L-W Set

Default version status: unaffected

  • 0 to < v2.3.0.r5542affected

Welotec TK525U

Default version status: unaffected

  • 0 to < v2.3.0.r5542affected

Welotec TK525U Set

Default version status: unaffected

  • 0 to < v2.3.0.r5542affected

Welotec TK525W

Default version status: unaffected

  • 0 to < v2.3.0.r5542affected

Welotec TK525W Set

Default version status: unaffected

  • 0 to < v2.3.0.r5542affected

Welotec TK535L1

Default version status: unaffected

  • 0 to < v2.3.0.r5542affected

Welotec TK535L1 Set

Default version status: unaffected

  • 0 to < v2.3.0.r5542affected

References