Command Injection in ZeroTier VPN

Summary

Improper input validation in the ZeroTier VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.

Remediation

1. Inventory every Welotec TK100 deployment, including staging.
2. Upgrade Welotec TK100 to the fixed version for your release line, listed under Affected versions.
3. Confirm the running version after the upgrade.

References

• Referencehttps://www.certvde.com/en/advisories/VDE-2026-119/