Improper validation of inputs in the ZeroTier VPN feature exposes devices to command injection. If an attacker can send crafted data, they can execute arbitrary commands as root. This flaw gives an attacker the same privilege level as the systemd service running the VPN, leading to full control over the device, data exfiltration, and potential lateral movement in a network. The weakness is a classic command injection flaw (CWE‑77).

The vulnerability affects Welotec TK100, TK500‑v2, and TK500‑v3 hardware. No specific firmware or software version numbers are listed, so any device running these models with the unpatched ZeroTier VPN component is at risk.

The CVSS score of 8.6 indicates a high severity vulnerability. The EPSS score is not available, so exact exploitation frequency is unknown, but the lack of a KEV listing suggests it has not yet been widely exploited in the wild. The likely attack path requires the attacker to have remote network access to the device and sufficient privileges to submit data to the VPN interface. If those conditions are met, the attacker can execute commands with root privileges.