Improper input validation in the WireGuard VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges. The vulnerability is a classic command injection flaw that could lead to complete system compromise if exploited. The attacker could run arbitrary shell commands, gain full control, exfiltrate data, modify configuration, or plant persistence mechanisms.

The affected devices are Welotec TK100, TK500-v2, and TK500-v3 hardware routers. No specific firmware versions are listed, so all current and legacy releases should be considered potentially vulnerable.

The CVSS v3 score of 8.6 indicates a high severity for remote code execution. EPSS is not available, but lack of a documented exploit does not reduce risk. The vulnerability is not currently listed in CISA KEV. The likely attack vector is a remote attacker who can send crafted input to the WireGuard VPN service; with elevated privileges, arbitrary commands would run under the root account. This could be exploited from within the local network or by an authenticated attacker with VPN access.