CVE-2023-1083 — Welotec: improper access control in TK500v1 router series

Description (CNA)

An unauthenticated remote attacker who is aware of a MQTT topic name can send and receive messages, including GET/SET configuration commands, reboot commands and firmware updates.

Affected (CNA)

Vendor / product	Versions
Welotec / TK515L	affected 0 before v2.3.0.r5542
Welotec / TK515L Set	affected 0 before v2.3.0.r5542
Welotec / TK515L-W	affected 0 before v2.3.0.r5542
Welotec / TK515L-W Set	affected 0 before v2.3.0.r5542
Welotec / TK525L	affected 0 before v2.3.0.r5542
Welotec / TK525L Set	affected 0 before v2.3.0.r5542
Welotec / TK525L-W	affected 0 before v2.3.0.r5542
Welotec / TK525L-W Set	affected 0 before v2.3.0.r5542
Welotec / TK525U	affected 0 before v2.3.0.r5542
Welotec / TK525U Set	affected 0 before v2.3.0.r5542
Welotec / TK525W	affected 0 before v2.3.0.r5542
Welotec / TK525W Set	affected 0 before v2.3.0.r5542
Welotec / TK535L1	affected 0 before v2.3.0.r5542
Welotec / TK535L1 Set	affected 0 before v2.3.0.r5542

CWE

CWE-306

References

https://cert.vde.com/en/advisories/VDE-2024-009

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

https://cert.vde.com/en/advisories/VDE-2024-009