Description
Insufficient bounds checking in the Digital I/O function may allow a remote attacker with high privileges to cause a denial of service.
Published: 2026-11-03
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Assess Impact
AI Analysis

Impact

An insufficient bounds check in the Digital I/O function allows a buffer overflow that can destabilize the device when invoked by an attacker with high privileges. The flaw leads to a crash and loss of availability, matching the characteristics of a denial of service. This is a classic memory corruption vulnerability.

Affected Systems

Welotec TK100, Welotec TK500‑v2, and Welotec TK500‑v3 are affected. No specific firmware or software version numbers are listed.

Risk and Exploitability

The CVSS score of 6.9 indicates a medium severity risk. EPSS is not available, so the current exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is remote, requiring an attacker to send a specially crafted Digital I/O command from a position of relative privilege.

Generated by OpenCVE AI on November 3, 2026 at 10:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Disable or isolate the Digital I/O functionality if it is not required in the deployment environment.
  • Apply any available firmware or software updates from Welotec that address the bounds‑checking issue as soon as they become available.
  • Restrict remote privileged access to the device, ensuring that only authenticated, least‑privilege users can invoke high‑privilege functions.

Generated by OpenCVE AI on November 3, 2026 at 10:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 03 Nov 2026 09:15:00 +0000

Type Values Removed Values Added
Description Insufficient bounds checking in the Digital I/O function may allow a remote attacker with high privileges to cause a denial of service.
Title Buffer Overflow in Digital I/O
First Time appeared Welotec
Welotec tk100
Welotec tk500 V2
Welotec tk500 V3
Weaknesses CWE-120
CPEs cpe:2.3:h:welotec:tk100:*:*:*:*:*:*:*:*
cpe:2.3:h:welotec:tk500_v2:*:*:*:*:*:*:*:*
cpe:2.3:h:welotec:tk500_v3:*:*:*:*:*:*:*:*
Vendors & Products Welotec
Welotec tk100
Welotec tk500 V2
Welotec tk500 V3
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Welotec Tk100 Tk500 V2 Tk500 V3
cve-icon MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published:

Updated: 2026-11-03T09:00:27.914Z

Reserved: 2026-10-12T12:21:23.781Z

Link: CVE-2026-109161

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-03T09:17:10.497

Modified: 2026-11-03T09:17:10.497

Link: CVE-2026-109161

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-03T10:30:13Z

Weaknesses
  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')