CVE-2023-2587

Teltonika RMS (Remote Management System) and its RUT routers are affected by multiple CVEs (CVE-2023-32346, -32347, -32348, -32349, -32350, -2587, -2586, -2588) due to XSS, improper authentication, SSRF, OS command injection, and exposed configuration. RMS pre-4.10.0 and RMS pre-4.14.0 (for -2586...

CVE-2023-32347

Teltonika RMS and related RUT devices are affected by multiple CVEs (CVE-2023-32346/32347/32348/32349/32350, and 32358 in some sources) affecting authentication, device claiming, SSRF, remote code execution, and OS command injection. Affected: RMS versions prior to 4.10.0 (and 4.14.0 for CVE-2023...

CVE-2023-2588

CVE-2023-2588 affects Teltonika’s Remote Management System (RMS) prior to 4.10.0. The RMS web proxy feature can be requested to obtain a URL in the RMS cloud subdomain, which may be shared without authenticating to RMS. An attacker could construct a malicious webpage using a trusted domain and tr...

CVE-2023-32348

CVE-2023-32348 affects Teltonika RMS (pre-4.10.0) and related RUT routers. The issue arises from the RMS VPN hub feature using OpenVPN, which allows new devices to communicate with all VPN-connected devices and enables routing through the OpenVPN server. This can let an attacker route traffic to ...

CVE-2023-2586

Teltonika RMS is affected by CVE-2023-2586 (and related RMS flaws) in versions prior to 4.14.0. The root cause is improper authentication enabling an unauthorized attacker to register previously unregistered devices, potentially leading to remote code execution with root privileges via the RMS Ta...

CVE-2023-32346

Teltonika RMS (Remote Management System) and RUT router firmware are affected by multiple CVEs (CVE-2023-32346, -32347, -32348, -2586, -2587, -2588, -32349, -32350) affecting versions prior to 4.10.0 (RMS) and prior to 4.14.0 (RMS, per CVE-2586) / 00.07.00–00.07.03.x (RUT). The root causes includ...