CVE-2023-31728

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

Teltonika RUT240 devices with firmware before 07.04.2, when bridge mode is used, sometimes make SSH and HTTP services available on the IPv6 WAN interface even though the UI shows that they are only available on the LAN interface.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
teltonika-networks	rut240_firmware	< 07.04.2

References

https://research.exoticsilicon.com/articles/lte_ethernet_bridge_bug_followupThird Party Advisory
https://research.exoticsilicon.com/newsThird Party Advisory
https://research.exoticsilicon.com/articles/lte_ethernet_bridge_bug_followupThird Party Advisory
https://research.exoticsilicon.com/newsThird Party Advisory

Timeline

Published: Feb 17, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-317299.8TOTOLINK A3300R v17.0.0cu.557 is vulnerable to Command Injection via /cgi-bin/cstecgi.cgi.CVE-2023-31739.8Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20.CVE-2023-317407.2There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06. If an attacker gains web management pri CVE-2023-317417.2There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06. If an attacker gains web management pri CVE-2023-317427.2There is a command injection vulnerability in the Linksys WRT54GL router with firmware version 4.30.18.006. If an attacker gains web managem CVE-2023-317469.8There is a command injection vulnerability in the adslr VW2100 router with firmware version M1DV1.0. An unauthenticated attacker can exploit CVE-2023-317477.8Wondershare Filmora 12 (Build 12.2.1.2088) was discovered to contain an unquoted service path vulnerability via the component NativePushServ CVE-2023-317487.8Insecure permissions in MobileTrans v4.0.11 allows attackers to escalate privileges to local admin via replacing the executable file.CVE-2023-31754.8The AI ChatBot WordPress plugin before 4.6.1 does not adequately escape some settings, allowing high-privilege users such as admin to perfor CVE-2023-317529.8SourceCodester Employee and Visitor Gate Pass Logging System v1.0 is vulnerable to SQL Injection via /employee_gatepass/classes/Login.php.CVE-2023-317539.8SQL injection vulnerability in diskusi.php in eNdonesia 8.7, allows an attacker to execute arbitrary SQL commands via the "rid=" parameter.CVE-2023-317544.8Optimizely CMS UI before v12.16.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Admin panel.