Most recent entries from csaf_welotecgmbh

VDE-2025-085 — Welotec: Path Traversal in SmartEMS Upload Handling

Wed, 10 Sep 2025 07:00:00 +0000

A path traversal flaw in the SmartEMS upload handling allows authenticated users to direct upload data outside of the intended directory via the 'Upload-Key' header. In deployments where writable, code-interpreted paths are reachable, this may lead to remote code execution.

VDE-2025-076 — Welotec: Hard-coded JWT secret in egOS WebGUI

Tue, 26 Aug 2025 07:00:00 +0000

A hard-coded JWT secret in the egOS WebGUI backend is readable to the default user, allowing attackers to forge valid tokens and access protected API endpoints.

VDE-2024-009 — Welotec: Two vulnerabilities in TK500v1 router series

Tue, 09 Apr 2024 08:00:00 +0000

An unauthenticated remote attacker who is aware of a MQTT topic name can send and receive messages, including GET/SET configuration commands, reboot commands and firmware updates. An remote attacker with low privileges can perform a command injection which can lead to root access.

VDE-2024-043 — Welotec: Multiple products are vulnerable to regreSSHion

Thu, 22 Aug 2024 06:00:00 +0000

Products from the Edge Gateway Family are affected by recently published so called RegreSSHion vulnerability.

VDE-2024-023 — Welotec: Clickjacking Vulnerability in WebUI

Tue, 23 Apr 2024 08:00:00 +0000

Welotec has been informed by an external source that the WebUI of the device management solution "SMART EMS" and the remote connectivity solution "VPN Security Suite" is vulnerable to so-called "Clickjacking" and advises to update to version v3.1.4 or later.