Description
In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to those requests not following proper flows, this could lead to OS command execution.
This issue affects RUT: from 7.22 through 7.24.2; RUTX: from 7.22 through 7.24.2; RUTM: from 7.22 through 7.24.2; RUTC: from 7.22 through 7.24.2; ATRM: from 7.22 through 7.24.2; TAP: from 7.22 through 7.24.2; CAP: from 7.22 through 7.24.2; OXA: from 7.22 through 7.24.2; DAP: from 7.22 through 7.24.2; TRB: from 7.22 through 7.24.2; OTD: from 7.22 through 7.24.2; EBG: from 7.22 through 7.24.2; SWM: from 1.9 through 1.10; TSW: from 1.9 through 1.10.
Metrics
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XWeakness enumeration
Affected software
Source: the vendor's advisory (CNA). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Teltonika Networks | RUT | >= 7.22, <= 7.24.2 |
| Teltonika Networks | RUTX | >= 7.22, <= 7.24.2 |
| Teltonika Networks | RUTM | >= 7.22, <= 7.24.2 |
| Teltonika Networks | RUTC | >= 7.22, <= 7.24.2 |
| Teltonika Networks | ATRM | >= 7.22, <= 7.24.2 |
| Teltonika Networks | TAP | >= 7.22, <= 7.24.2 |
| Teltonika Networks | CAP | >= 7.22, <= 7.24.2 |
| Teltonika Networks | OXA | >= 7.22, <= 7.24.2 |
| Teltonika Networks | DAP | >= 7.22, <= 7.24.2 |
| Teltonika Networks | TRB | >= 7.22, <= 7.24.2 |
| Teltonika Networks | OTD | >= 7.22, <= 7.24.2 |
| Teltonika Networks | EBG | >= 7.22, <= 7.24.2 |
| Teltonika Networks | SWM | >= 1.9, <= 1.10 |
| Teltonika Networks | TSW | >= 1.9, <= 1.10 |
References
Timeline
- Published
- Oct 30, 2026
- Last modified
- Oct 30, 2026
- NVD status
- Awaiting Analysis