# CVE-2026-105980

Command injection in WireGuard allows root code execution via crafted input.

- Page: https://www.vulneraibility.com/cve/CVE-2026-105980
- CVSS: 8.6
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-77
- Published: 2026-11-03

## Affected versions

- Welotec TK100: affected < 3.5.116
- Welotec TK500-v2: affected < 1.0.124
- Welotec TK500-v3: affected < 1.0.123

A version outside these ranges is not a statement that it is unaffected.

## Impact

Command injection via WireGuard input enabling remote/root code execution and full host compromise.

## Action

Immediate action required

## Recommendation

Disable/unload WireGuard if feasible, restrict access and privileges, monitor logs, apply vendor patch when available.

## References

- [other] https://www.certvde.com/en/advisories/VDE-2026-119/

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.