Teltonika RUTOS CVE-2026-16455

Exploitation requires two concrete prerequisites: (1) the attacker must have a valid, low-privileged (non-admin) user account on the target RUTOS or TSWOS device, and (2) the attacker must have adjacent network access to the device management interface - this rules out unauthenticated remote exploitation from the internet. The vulnerable execl() code path is reachable by any authenticated low-privileged user on affected firmware versions without any non-default configuration being required. Limiting factors: without a valid device account, exploitation is not possible regardless of network position; network segmentation that restricts management-plane access from untrusted hosts raises the bar significantly for external attackers.

The CVSS 4.0 base score of 6.9 is driven by AV:A (adjacent network), PR:L (low privileges required), and VI:H (high integrity impact), while VC and VA are both rated N - suggesting the vendor characterizes the impact as integrity-only. This appears to understate real-world impact: administrative access on a router or switch typically enables full confidentiality (reading credentials, VPN keys, firewall rules) and availability (rebooting, disabling interfaces) impact as well. The adjacent-network attack vector (AV:A) meaningfully limits exploitability to actors already present on the device's management network, ruling out internet-wide opportunistic scanning. No EPSS score was provided, and the vulnerability is not in CISA KEV, indicating no confirmed active exploitation. POC availability is unknown. The combination of PR:L (requires a valid device account) and AV:A substantially reduces the realistic attacker pool to insiders, compromised LAN hosts, or attackers who have already gained network adjacency. Despite these constraints, privilege escalation to admin on a network device is a high-severity outcome in industrial and OT environments where these routers are commonly deployed.

An attacker who has obtained a low-privileged user account on an affected Teltonika RUTOS device - whether through credential theft, default credentials, or phishing - connects to the device management interface from within the adjacent network. By invoking a vulnerable function that makes an unsafe execl() call with attacker-influenced arguments, the user's process is relaunched with administrative privileges, granting full control over device configuration, routing tables, firewall rules, and connected network segments. No public proof-of-concept code has been identified at time of analysis.