Teltonika RUTOS EUVD-2026-113748

Exploitation requires adjacent-network access (AV:A): the attacker must be able to reach the device's management/service interface from the same local or adjacent network segment (e.g. LAN side or shared broadcast domain), not from the arbitrary internet. Within that position no authentication (PR:N) and no user interaction (UI:N) are needed. The concrete prerequisite is the ability to directly call internal LUA functions, bypassing the validations enforced on normal API requests; any device running RUTOS 7.22 through 7.24.2 or TSWOS 1.9 through 1.10 in default configuration is affected. The principal limiting factor is the adjacency requirement - the vulnerable interface must be network-reachable from the attacker's segment; devices whose management plane is isolated from untrusted segments are correspondingly harder to reach.

This is a genuine high-priority issue, consistent with the act_now decision label. The CVSS 4.0 base score of 9.4 reflects an unauthenticated (PR:N), low-complexity (AC:L), no-interaction (UI:N) flaw with high confidentiality, integrity and availability impact on both the vulnerable device (VC:H/VI:H/VA:H) and subsequent systems (SC:H/SI:H/SA:H), matching the description's outcome of OS command execution. The one signal that tempers raw internet-wide risk is the attack vector: AV:A (adjacent), not AV:N - an attacker must sit on the same local/adjacent network segment rather than reach the device from anywhere on the internet. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no proof-of-concept or exploit reference is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The urgency therefore rests on severity, the unauthenticated/low-complexity profile, and the criticality of the affected networking hardware rather than on observed exploitation. Note the gap explicitly: the act_now priority is driven by impact and exposure, while exploitation-probability signals (EPSS, KEV, POC) are absent and cannot be confirmed from the available data.

An attacker positioned on an adjacent network segment reachable by the device sends a crafted request that directly invokes an internal LUA function, bypassing the validation that normally gates those functions through the API. Because the call skips the proper request flow, the attacker achieves OS command execution on the device. No authentication or user interaction is required; no public proof-of-concept is referenced in the available data.