Plan ahead High Check your exposure
Welotec TK routers have flaws that could give an attacker full control
CERT@VDE advisoriesWelotec
What happened. Several flaws in the web management functions of Welotec routers, including VPN-related functions, let a remote attacker with high privileges inject commands or cause a buffer overflow. This could give root-level command execution or a denial of service.
Who is affected. Users of Welotec TK routers. Industrial sites using them for remote access are exposed, because vendors and engineers often reach plant systems through such routers.
What to do. Check whether you run Welotec TK routers and follow advisory VDE-2026-119 for fixes from the vendor.
When to act. Plan ahead: judged high and no score stated: check the vendor advisory
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L5
- L3.5
Why: Routers with VPN functions are boundary devices that carry remote access into plant networks, so they sit at the industrial DMZ (L3.5) or the edge (L5).
- Are you exposed?
Search the asset inventory and network scans for Welotec TK routers and check whether their web management interface is reachable from untrusted networks.
- If you cannot fix it yet
- Limit the router web management interface to a small set of trusted administration hosts.
- Require multi-factor authentication for VPN and administrator logons, and use strong unique admin credentials.
- Keep the management interface off the internet and off the plant network until patched.
- Watch for
- Administrator logons to the router web interface from unexpected addresses or at unusual times.
- Unexpected router restarts, configuration changes or new processes that could point to command injection or a crash.
- ATT&CK for ICS
- T0866Exploitation of Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: CERT@VDE advisories (opens certvde.com)
More on Welotec