API permission bypass via logic bug (Teltonika Networks RUT)
En bref
- Source
- NVD
- EPSS
- EPSS 0.42 % · centile 36 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- tlt_net
- Statut NVD
- Awaiting Analysis
Description
In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to those requests not following proper flows, this could lead to OS command execution. This issue affects RUT: from 7.22 through 7.24.2; RUTX: from 7.22 through 7.24.2; RUTM: from 7.22 through 7.24.2; RUTC: from 7.22 through 7.24.2; ATRM: from 7.22 through 7.24.2; TAP: from 7.22 through 7.24.2; CAP: from 7.22 through 7.24.2; OXA: from 7.22 through 7.24.2; DAP: from 7.22 through 7.24.2; TRB: from 7.22 through 7.24.2; OTD: from 7.22 through 7.24.2; EBG: from 7.22 through 7.24.2; SWM: from 1.9 through 1.10; TSW: from 1.9 through 1.10.
Faiblesses (CWE)
- CWE-306 — Authentification absente sur une fonction critique
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 4.0 | CRITICAL 9.4 | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | tlt_net |
| CVSS 4.0 | CRITICAL 9.4 | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · 001d69cf-3fc9-4203-93fb-9865b54e05b2 (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-113748
- GCVE · GCVE-0-2026-82104
Produits affectés
| Produit | Versions |
|---|---|
| Teltonika Networks · RUT | affected 7.22 ≤ 7.24.2 |
| Teltonika Networks · RUTX | affected 7.22 ≤ 7.24.2 |
| Teltonika Networks · RUTM | affected 7.22 ≤ 7.24.2 |
| Teltonika Networks · RUTC | affected 7.22 ≤ 7.24.2 |
| Teltonika Networks · ATRM | affected 7.22 ≤ 7.24.2 |
| Teltonika Networks · TAP | affected 7.22 ≤ 7.24.2 |
| Teltonika Networks · CAP | affected 7.22 ≤ 7.24.2 |
| Teltonika Networks · OXA | affected 7.22 ≤ 7.24.2 |
| Teltonika Networks · DAP | affected 7.22 ≤ 7.24.2 |
| Teltonika Networks · TRB | affected 7.22 ≤ 7.24.2 |
| Teltonika Networks · OTD | affected 7.22 ≤ 7.24.2 |
| Teltonika Networks · EBG | affected 7.22 ≤ 7.24.2 |
| Teltonika Networks · SWM | affected 1.9 ≤ 1.10 |
| Teltonika Networks · TSW | affected 1.9 ≤ 1.10 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |