by Kastro
Paper/Archive/CVE-2023-1083

CVE-2023-1083

Welotec TK515L — Welotec: improper access control in TK500v1 router series

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 52.4.524 × 2010.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An unauthenticated remote attacker who is aware of a MQTT topic name can send and receive messages, including GET/SET configuration commands, reboot commands and firmware updates.

Affected

ProductAffectedFixed inSource
TK515L< v2.3.0.r5542v2.3.0.r5542CNA
TK515L Set< v2.3.0.r5542v2.3.0.r5542CNA
TK515L-W< v2.3.0.r5542v2.3.0.r5542CNA
TK515L-W Set< v2.3.0.r5542v2.3.0.r5542CNA
TK525L< v2.3.0.r5542v2.3.0.r5542CNA
TK525L Set< v2.3.0.r5542v2.3.0.r5542CNA
TK525L-W< v2.3.0.r5542v2.3.0.r5542CNA
TK525L-W Set< v2.3.0.r5542v2.3.0.r5542CNA
TK525U< v2.3.0.r5542v2.3.0.r5542CNA
TK525U Set< v2.3.0.r5542v2.3.0.r5542CNA
TK525W< v2.3.0.r5542v2.3.0.r5542CNA
TK525W Set< v2.3.0.r5542v2.3.0.r5542CNA

Scores by source

CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcert.vde.com/en/advisories/VDE-2024-009