Teltonika Command Injection in Backup function (Teltonika Networks RUT)
En bref
- Source
- NVD
- EPSS
- EPSS 0.94 % · centile 61 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- tlt_net
- Statut NVD
- Deferred
Rechercher sur…
Description
Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 before 1.10.4 (TSW and SWM devices) allows a remote authenticated attacker to execute arbitrary OS commands.
Faiblesses (CWE)
- CWE-78 — Injection de commande système
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 4.0 | HIGH 8.5 | CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | tlt_net |
| CVSS 4.0 | HIGH 8.5 | CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · 001d69cf-3fc9-4203-93fb-9865b54e05b2 (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-98316
- GCVE · GCVE-0-2026-75826
Produits affectés
| Produit | Versions |
|---|---|
| Teltonika Networks · RUT | affected 7.22 < 7.24.6 |
| Teltonika Networks · RUTX | affected 7.22 < 7.24.6 ; affected 7.22 < 7.25.2 |
| Teltonika Networks · RUTM | affected 7.22 < 7.24.6 ; affected 7.22 < 7.25.2 |
| Teltonika Networks · RUTC | affected 7.22 < 7.24.6 |
| Teltonika Networks · ATRM | affected 7.22 < 7.24.6 |
| Teltonika Networks · TAP | affected 7.22 < 7.25.2 |
| Teltonika Networks · CAP | affected 7.22 < 7.24.6 |
| Teltonika Networks · OXA | affected 7.22 < 7.24.6 |
| Teltonika Networks · DAP | affected 7.22 < 7.24.6 |
| Teltonika Networks · TRB | affected 7.22 < 7.24.6 |
| Teltonika Networks · OTD | affected 7.22 < 7.24.6 |
| Teltonika Networks · EBG | affected 7.22 < 7.24.6 |
| Teltonika Networks · SWM | affected 1.9 < 1.10.4 |
| Teltonika Networks · TSW | affected 1.9 < 1.10.4 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |