Most recent entries from csaf_welotecgmbh

VDE-2025-085 — Welotec: Path Traversal in SmartEMS Upload Handling

2025-09-22T08:00:00+00:00

A path traversal flaw in the SmartEMS upload handling allows authenticated users to direct upload data outside of the intended directory via the 'Upload-Key' header. In deployments where writable, code-interpreted paths are reachable, this may lead to remote code execution.

VDE-2025-076 — Welotec: Hard-coded JWT secret in egOS WebGUI

2025-08-26T07:00:00+00:00

A hard-coded JWT secret in the egOS WebGUI backend is readable to the default user, allowing attackers to forge valid tokens and access protected API endpoints.

VDE-2024-009 — Welotec: Two vulnerabilities in TK500v1 router series

2025-05-14T12:28:19+00:00

An unauthenticated remote attacker who is aware of a MQTT topic name can send and receive messages, including GET/SET configuration commands, reboot commands and firmware updates. An remote attacker with low privileges can perform a command injection which can lead to root access.

VDE-2024-043 — Welotec: Multiple products are vulnerable to regreSSHion

2024-08-22T06:00:00+00:00

Products from the Edge Gateway Family are affected by recently published so called RegreSSHion vulnerability.

VDE-2024-023 — Welotec: Clickjacking Vulnerability in WebUI

2024-04-23T08:00:00+00:00

Welotec has been informed by an external source that the WebUI of the device management solution "SMART EMS" and the remote connectivity solution "VPN Security Suite" is vulnerable to so-called "Clickjacking" and advises to update to version v3.1.4 or later.