CVE-2026-82104

In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to...

CVE-2026-82104 API permission bypass via logic bug

In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to...

CVE-2026-82104 API permission bypass via logic bug

In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to...

EUVD-2026-113748

In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to...

CVE-2026-82104

Teltonika Networks RUTOS and TSWOS devices are vulnerable to a logic bug that allows an unauthenticated user to directly call LUA functions . By bypassing the standard validation flows of normal API requests, an attacker could achieve OS command execution . This issue affects RUT, RUTX, RUTM, RUT...

CVE-2026-82104: Teltonika Networks: In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9…

In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to...

PT-2026-133307

Name of the Vulnerable Software and Affected Versions RUTOS versions 7.22 through 7.24.2 TSWOS versions 1.9 through 1.10 Description An unauthenticated user can directly call internal LUA functions, bypassing validations typically required during normal API requests. Because these requests do not...

Teltonika RutOS ipsec status logread injection — Detect

Fingerprint RutOS VuCI web UI and ipsec/openvpn API surface for authenticated logread command-injection advisory. !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Teltonika RutOS ipsec status logread command injection.""" from kittysploit import from lib.protocols.http.httpclient import...

Teltonika RutOS ipsec status logread command injection

Post-authentication OS command injection in Teltonika RutOS 00.07.06.21 RUT2XX / RUT200; RUT9XX byte-identical ipsec.lua. GET /api/ipsec/status/ passes the URL-decoded sid into logread -e '-c|' without shell quoting; vuci.util.exec runs /bin/sh -c and returns stdout in JSON .data.logs reflective...

CVE-2026-75826

Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices, RUTOS 7.22 before 7.25.2 TAP devices, and TSWOS 1.9 before 1.10.4 TSW and SWM devices allows a remote authenticated...

CVE-2026-75826 Teltonika Command Injection in Backup function

Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices, RUTOS 7.22 before 7.25.2 TAP devices, and TSWOS 1.9 before 1.10.4 TSW and SWM devices allows a remote authenticated...

CVE-2026-75826

A command injection vulnerability exists in the backup function of Teltonika Networks devices. This flaw allows a remote authenticated attacker to execute arbitrary OS commands. Affected software includes RUTOS 7.22 (before 7.24.6 for most devices; before 7.25.2 for TAP devices), RUTOS 7.25 (befo...

CVE-2026-75826 Teltonika Command Injection in Backup function

Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices, RUTOS 7.22 before 7.25.2 TAP devices, and TSWOS 1.9 before 1.10.4 TSW and SWM devices allows a remote authenticated...

EUVD-2026-98316

Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices, RUTOS 7.22 before 7.25.2 TAP devices, and TSWOS 1.9 before 1.10.4 TSW and SWM devices allows a remote authenticated...

PT-2026-111296

Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices, RUTOS 7.22 before 7.25.2 TAP devices, and TSWOS 1.9 before 1.10.4 TSW and SWM devices allows a remote authenticated...

CVE-2026-75826: Improper Neutralization of Special Elements used in an OS Command

Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices, RUTOS 7.22 before 7.25.2 TAP devices, and TSWOS 1.9 before 1.10.4 TSW and SWM devices allows a remote authenticated...

Teltonika Networks RUTOS command injection vulnerability

Teltonika Networks’ RUTOS versions from 7.22 to 7.24.6, as well as versions from 7.25 to 7.25.2, and also versions from 7.22 to 7.25.2, along with Teltonika Networks’ TSWOS version from 1.9 to 1.10.4, have command injection vulnerabilities. These vulnerabilities stem from command injection in the...

CVE-2026-18368

In Teltonika Networks RUTOS devices, a vulnerability exists in modbusgwd due to improper handling of Modbus TCP request data. A remote, unauthenticated attacker with access to the affected service could trigger a heap-based buffer overflow, resulting in a denial of service...

CVE-2026-16455

In Teltonika Networks RUTOS devices running versions 7.07.1 through 7.24.1 and TSWOS devices running versions 1.03 through 1.10, a vulnerability exists whereby a lower privileged user can escalate privileges to administrative level due to unsafe calls to an execl function...

CVE-2026-18368

In Teltonika Networks RUTOS devices, a vulnerability exists in modbusgwd due to improper handling of Modbus TCP request data. A remote, unauthenticated attacker with access to the affected service could trigger a heap-based buffer overflow, resulting in a denial of service...