This vulnerability arises from insufficient input validation in the management control functions of certain Welotec hardware devices. A remote attacker who already possesses high‑privilege credentials can inject arbitrary operating‑system commands. When the device processes these commands, they execute with root privileges, allowing the attacker to take complete control of the device or use it as a foothold for further network compromise. The flaw corresponds to the OS Command Injection weakness, classified as CWE‑78. Given the high severity (CVSS 8.6), exploitation would lead to full confidentiality, integrity and availability compromise of the affected systems.

The identified target products are Welotec TK100, Welotec TK500‑v2, and Welotec TK500‑v3. Specific affected firmware or software versions are not listed in the advisory, so all current releases of these models should be reviewed.

The CVSS base score of 8.6 indicates a high likelihood of severe impact if successful. No EPSS score is available, and this vulnerability is not currently listed in CISA's KEV catalogue, suggesting it may not yet be widely exploited but still poses a significant risk to any system where attackers could gain privileged access. The attack vector is remote; an adversary that can authenticate to the administrative interface with sufficient privileges can construct malicious input to trigger command execution.