CVE-2023-1083
Critical
Description
An unauthenticated remote attacker who is aware of a MQTT topic name can send and receive messages, including GET/SET configuration commands, reboot commands and firmware updates.
SeverityCritical
CVSS9.8
Exploit probability—
ProductTK515L
PublishedApr 9, 2024
First seenApr 9, 2024
Weakness typeCWE-306Missing authentication for critical function
How to fix
Update
- Welotec TK515Lv2.3.0.r5542 or later
- Welotec TK515L Setv2.3.0.r5542 or later
- Welotec TK515L-Wv2.3.0.r5542 or later
- Welotec TK515L-W Setv2.3.0.r5542 or later
- Welotec TK525Lv2.3.0.r5542 or later
- Welotec TK525L Setv2.3.0.r5542 or later
- Welotec TK525L-Wv2.3.0.r5542 or later
- Welotec TK525L-W Setv2.3.0.r5542 or later
- Welotec TK525Uv2.3.0.r5542 or later
- Welotec TK525U Setv2.3.0.r5542 or later
- Welotec TK525Wv2.3.0.r5542 or later
- Welotec TK525W Setv2.3.0.r5542 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Welotec TK515L | v < v2.3.0.r5542 | v2.3.0.r5542 |
| Welotec TK515L Set | v < v2.3.0.r5542 | v2.3.0.r5542 |
| Welotec TK515L-W | v < v2.3.0.r5542 | v2.3.0.r5542 |
| Welotec TK515L-W Set | v < v2.3.0.r5542 | v2.3.0.r5542 |
| Welotec TK525L | v < v2.3.0.r5542 | v2.3.0.r5542 |
| Welotec TK525L Set | v < v2.3.0.r5542 | v2.3.0.r5542 |
| Welotec TK525L-W | v < v2.3.0.r5542 | v2.3.0.r5542 |
| Welotec TK525L-W Set | v < v2.3.0.r5542 | v2.3.0.r5542 |
| Welotec TK525U | v < v2.3.0.r5542 | v2.3.0.r5542 |
| Welotec TK525U Set | v < v2.3.0.r5542 | v2.3.0.r5542 |
| Welotec TK525W | v < v2.3.0.r5542 | v2.3.0.r5542 |
| Welotec TK525W Set | v < v2.3.0.r5542 | v2.3.0.r5542 |
| Welotec TK535L1 | v < v2.3.0.r5542 | v2.3.0.r5542 |
| Welotec TK535L1 Set | v < v2.3.0.r5542 | v2.3.0.r5542 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.