Lucene search

[email protected]NVD:CVE-2023-32350

HistoryMay 22, 2023 - 4:15 p.m.

CVE-2023-32350

2023-05-2216:15:10

CWE-78

[email protected]

web.nvd.nist.gov

teltonika

rut router

firmware

os command injection

lua service

vulnerability

operating system

command injection payload

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.8%

JSON

Versions 00.07.00 through 00.07.03 of Teltonika’s RUT router firmware contain an operating system (OS) command injection vulnerability in a Lua service. An attacker could exploit a parameter in the vulnerable function that calls a user-provided package name by instead providing a package with a malicious name that contains an OS command injection payload.

Affected configurations

NVD

Node

teltonika-networksrut200_firmwareRange00.07.00–00.07.03

AND

teltonika-networksrut200Match-

Node

teltonika-networksrut240_firmwareRange00.07.00–00.07.03

AND

teltonika-networksrut240Match-

Node

teltonika-networksrut241_firmwareRange00.07.00–00.07.03

AND

teltonika-networksrut241Match-

Node

teltonika-networksrut300_firmwareRange00.07.00–00.07.03

AND

teltonika-networksrut300Match-

Node

teltonika-networksrut360_firmwareRange00.07.00–00.07.03

AND

teltonika-networksrut360Match-

Node

teltonika-networksrut901_firmwareRange00.07.00–00.07.03

AND

teltonika-networksrut901Match-

Node

teltonika-networksrut950_firmwareRange00.07.00–00.07.03

AND

teltonika-networksrut950Match-

Node

teltonika-networksrut951_firmwareRange00.07.00–00.07.03

AND

teltonika-networksrut951Match-

Node

teltonika-networksrut955_firmwareRange00.07.00–00.07.03

AND

teltonika-networksrut955Match-

Node

teltonika-networksrut956_firmwareRange00.07.00–00.07.03

AND

teltonika-networksrut956Match-

Node

teltonika-networksrutx08_firmwareRange00.07.00–00.07.03

AND

teltonika-networksrutx08Match-

Node

teltonika-networksrutx09_firmwareRange00.07.00–00.07.03

AND

teltonika-networksrutx09Match-

Node

teltonika-networksrutx10_firmwareRange00.07.00–00.07.03

AND

teltonika-networksrutx10Match-

Node

teltonika-networksrutx11_firmwareRange00.07.00–00.07.03

AND

teltonika-networksrutx11Match-

Node

teltonika-networksrutx12_firmwareRange00.07.00–00.07.03

AND

teltonika-networksrutx12Match-

Node

teltonika-networksrutx14_firmwareRange00.07.00–00.07.03

AND

teltonika-networksrutx14Match-

Node

teltonika-networksrutx50_firmwareRange00.07.00–00.07.03

AND

teltonika-networksrutx50Match-

Node

teltonika-networksrutxr1_firmwareRange00.07.00–00.07.03

AND

teltonika-networksrutxr1Match-

References

www.cisa.gov/news-events/ics-advisories/icsa-23-131-08

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.8%

JSON

Related for NVD:CVE-2023-32350

cvelist1 prion1 cve1 ics1 thn1