Teltonika RUTOS CVE-2026-18368

The attacker must be positioned on the same network segment as the affected RUTOS device - adjacent network access (AV:A) is required, meaning direct internet exploitation is not possible without first pivoting to the local network. The Modbus TCP gateway feature must be explicitly enabled in the RUTOS configuration and the modbusgwd service must be accessible on the network; AT:P in the CVSS 4.0 vector confirms this deployment prerequisite. No authentication is required to submit Modbus TCP requests to modbusgwd once the service is reachable (PR:N). No user interaction is required. Limiting factors: the adjacent-network-only constraint eliminates mass internet exploitation; the Modbus gateway must be deliberately configured and enabled by an operator; and impact is strictly availability - no code execution, privilege escalation, or data exfiltration is indicated by available analysis.

Overall risk is moderate and tightly scoped to OT network environments. The CVSS 4.0 score of 6.0 with AV:A constrains exploitation to attackers already on the same Layer-2 or routed-adjacent network segment as the device, which meaningfully limits exposure compared to internet-facing services. AT:P (Attack Requirements: Present) further confirms that the Modbus TCP gateway must be actively configured and the service must be reachable - not a guaranteed default across all RUTOS deployments. Impact is purely availability-oriented: no confidentiality or integrity loss is assessed from the available data. No exploit code is publicly known and no CISA KEV listing exists, suggesting opportunistic mass exploitation is unlikely at this time. EPSS data was not available in the provided intelligence. Despite these constraints, operators in OT-heavy environments - including even a mid-sized municipal IT team in gliwice running SCADA infrastructure on Teltonika hardware - should treat this as a meaningful availability risk, since crashing modbusgwd in an active Modbus deployment could interrupt monitoring or control of field devices. The CVSS 4.0 score correctly reflects scope-constrained impact; this is not a high-urgency internet-facing RCE, but is a real denial-of-service risk within its attack surface.

An attacker already on the same network segment as a Teltonika RUTOS device running the Modbus TCP gateway sends a crafted Modbus TCP request with malformed or oversized payload data to port 502. The modbusgwd daemon processes the frame without adequate length validation, triggering a heap-based buffer overflow that corrupts process memory and crashes the daemon, denying Modbus TCP service to legitimate industrial clients. No public proof-of-concept code has been identified at time of analysis, but Modbus TCP is a well-documented open protocol and constructing malformed frames requires only basic protocol knowledge and a TCP connection.