ICS Advisories

Risk evaluation

Multiple vulnerabilities in the web-based management functions of the affected Welotec routers, including VPN-related functions, may allow a remote attacker with high privileges to inject commands or trigger a buffer overflow. Successful exploitation may result in command execution with root privileges or a denial of service.

Mitigation summary

Do not expose the management interface to the internet or other untrusted networks. Restrict management access to trusted administrator workstations using network segmentation and firewall rules.

Risk evaluation

Two memory-safety vulnerabilities in the PHP runtime bundled with SMART EMS allow an unauthenticated remote attacker to execute arbitrary code in the context of the PHP web worker. All SMART EMS versions up to and including v3.5.3 are affected. Exploitability and reliability depend on the PHP server interface, configuration, application behaviour, and worker reuse.

Mitigation summary

Do not expose the SMART EMS Web UI directly to the internet or other untrusted networks. Restrict access to trusted administrator workstations through network segmentation, firewall rules, or a VPN. Where operationally possible, enforce `memory_limit=-1` administratively and restart all PHP workers. Use a container or cgroup memory limit as an availability boundary and enforce conservative request-size, input, multipart-part, header, and nesting limits at the frontend. If multipart form data is not required, block such requests before they reach PHP. These measures reduce exposure to confirmed attack paths but are not a complete mitigation.

Risk evaluation

A path traversal flaw in the SmartEMS upload handling allows authenticated users to direct upload data outside of the intended directory via the 'Upload-Key' header. In deployments where writable, code-interpreted paths are reachable, this may lead to remote code execution.

Mitigation summary

Restrict access to the SmartEMS Web UI to trusted admin networks/VPN. Enforce strong credentials and rotate or revoke active tokens/sessions.

Risk evaluation

A hard-coded JWT secret in the egOS WebGUI backend is readable to the default user, allowing attackers to forge valid tokens and access protected API endpoints.

Mitigation summary

Temporarily disable the WebGUI or restrict network access to the WebGUI to trusted admin stations.

Risk evaluation

Welotec has closed two vulnerabilities in the TK500v1 router series and advises to update the routers to firmware version r5542 or later. An exploitation of the vulnerabilities can allow an attacker to manipulate the device.

Mitigation summary

Update the product to firmware v2.3.0.r5542 or later.

Risk evaluation

Products from the Edge Gateway Family are affected by recently published so called RegreSSHion vulnerability.

Mitigation summary

Disable SSH Access via CLI Command or Config Import locally or for a centrally managed device by changing the configuration in SMART EMSRefer to eG OS manual chapter 4.26 for further information

Risk evaluation

Welotec has been informed by an external source that the WebUI of the device management solution "SMART EMS" and the remote connectivity solution "VPN Security Suite" is vulnerable to so-called "Clickjacking" and advises to update to version v3.1.4 or later.

Mitigation summary

This vulnerability can be mitigated with the use of an additional Reverse Proxy and / or Web Application Firewall protecting the WebUI.