Description
Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 before 1.10.4 (TSW and SWM devices) allows a remote authenticated attacker to execute arbitrary OS commands.
Metrics
CVSS 4.0 8.5/10
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Teltonika Networks | RUT | >= 7.22, < 7.24.6 |
| Teltonika Networks | RUTX | >= 7.22, < 7.24.6; >= 7.22, < 7.25.2 |
| Teltonika Networks | RUTM | >= 7.22, < 7.24.6; >= 7.22, < 7.25.2 |
| Teltonika Networks | RUTC | >= 7.22, < 7.24.6 |
| Teltonika Networks | ATRM | >= 7.22, < 7.24.6 |
| Teltonika Networks | TAP | >= 7.22, < 7.25.2 |
| Teltonika Networks | CAP | >= 7.22, < 7.24.6 |
| Teltonika Networks | OXA | >= 7.22, < 7.24.6 |
| Teltonika Networks | DAP | >= 7.22, < 7.24.6 |
| Teltonika Networks | TRB | >= 7.22, < 7.24.6 |
| Teltonika Networks | OTD | >= 7.22, < 7.24.6 |
| Teltonika Networks | EBG | >= 7.22, < 7.24.6 |
| Teltonika Networks | SWM | >= 1.9, < 1.10.4 |
| Teltonika Networks | TSW | >= 1.9, < 1.10.4 |
References
Timeline
- Published
- Oct 13, 2026
- Last modified
- Oct 16, 2026
- NVD status
- Deferred