EUVD-2026-34794
GHSA-7p37-7qj9-8qff
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged device account
-
DeliveryReach rpc-profile RPC on management interface
-
ExploitSubmit crafted profile parameter with embedded code
-
ExecutionTrigger unsafe eval in rpcd handler
-
PersistExecute commands as root
-
ImpactInstall persistence or pivot to LAN
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Eval input sanitization
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must have authenticated access at a 'lower privileged' (non-root) user level on the device and the ability to reach the rpc-profile RPC endpoint on the local/management interface (CVSS AV:L, PR:H). The vulnerable code path is the rpc-profile handler in RUTOS 7.22-7.23.2 and TSWOS 1.09-1.09.1; older or newer firmware is not affected. No user interaction is required (UI:N) and the attack is deterministic (AC:L, AT:N). Limiting factors that reduce realistic risk: devices that do not provision sub-root admin accounts, devices whose management plane is firewalled to trusted operators only, and any fleet where the patched firmware has been rolled out. |
| Impact | Real-world risk is moderate-to-high for organizations that grant non-root admin profiles on these devices. CVSS 4.0 vector AV:L/AC:L/AT:N/PR:H/UI:N with VC:H/VI:H/VA:H confirms the attacker must already hold high-privilege credentials on the local/management interface, but once present, the path to root is reliable (low complexity, no user interaction, full CIA impact on the device). EPSS and SSVC data were not provided and CISA KEV does not list this CVE - consistent with no public exploit identified at time of analysis. The discrepancy worth flagging: PR:H plus the description's phrasing 'lower privileged user' suggests the bar is an authenticated non-root account (e.g., a read-only or limited admin role), not an unauthenticated attacker, so this is primarily a privilege-escalation/insider risk rather than a remote takeover primitive. Scope and subsequent-system metrics are all N, so blast radius stops at the compromised device unless it is reused as a pivot into the managed network. |
| Exploit ScenarioDerived | An attacker who has phished or otherwise obtained credentials for a limited Teltonika WebUI account (e.g., a contractor with monitoring-only access, or a shared low-tier admin password reused across a fleet) logs into the device, invokes the rpc-profile RPC with a crafted payload containing embedded code, and the unsanitized eval executes their command as root. From there they can install a persistent implant in the OpenWrt overlay, exfiltrate VPN/PSK material, or pivot into the LAN behind the router. No public exploit is identified at time of analysis, but CWE-95 eval flaws are typically trivial to weaponize once the parameter name is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 05, 2026
Privilege escalation via eval-based command injection in Teltonika Networks RUTOS (7.22-7.23.2) and TSWOS (1.09-1.09.1) allows an authenticated lower-privileged operator to execute arbitrary commands as root through the rpc-profile component. The flaw stems from unsafe evaluation of user-controllable input in a Lua/UCI RPC handler and is constrained to local/management-plane access, with no public exploit identified at time of analysis. The CVSS 4.0 score of 8.4 reflects total host compromise once a low-tier admin account is obtained on the device.
RemediationAI
Patch available per vendor advisory - consult the Teltonika Networks Security Centre at https://www.teltonika-networks.com/support/security-centre for the exact fixed firmware build for your device model and upgrade RUTOS beyond 7.23.2 and TSWOS beyond 1.09.1 once the vendor-listed release is identified (no specific fix version is independently confirmable from the data provided here). Until patched, restrict who holds non-root admin profiles on these devices: remove or downgrade unnecessary user accounts, audit existing role assignments, and ensure the WebUI/rpcd management interfaces are reachable only from a hardened management VLAN or VPN - accepting the operational trade-off that legitimate operators must use that bastioned path. Network-level egress filtering from the device itself can blunt post-exploitation pivoting but does not block the root escalation. Do not expose the management interface to the WAN.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Teltonika RUTOS and TSWOS are OpenWrt-derived firmware platforms used on RUT-series industrial cellular routers and TSW-series managed switches. The 'rpc-profile' endpoint is part of the device's ubus/RPC management surface (typically reachable via the WebUI or rpcd over local network), which exposes configuration profile operations. CWE-95 (Eval Injection) applies because the handler passes operator-supplied parameters into a dynamic evaluation primitive - almost certainly a Lua loadstring/eval or shell eval invocation - without sanitization, so syntactically valid payloads are executed in the privileged context of the rpcd worker, which runs as root. CPE strings cpe:2.3:a:teltonika_networks:rutos:*:* and :tswos:*:* confirm both product lines share the vulnerable component.
Know when Rutos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1, due to unsafe calls to an eval function in rpc-profile, a vulnerability exists where a lower privileged user could perform command injection as the root user.
Executive ViewAI
Teltonika RUTOS and TSWOS network devices (versions 7.22-7.23.2 and 1.09-1.09.1) contain a privilege escalation vulnerability allowing any authenticated operator account to execute arbitrary commands as root, granting complete control of affected infrastructure. Organizations deploying these devices face total compromise risk if operator credentials are breached or exploited by insiders.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict management interface access to trusted administrative personnel only; (2) Enforce multi-factor authentication for all operator-level accounts; (3) Implement network segmentation isolating device management traffic; (4) Monitor authentication logs and RPC calls for unauthorized escalation attempts; (5) Apply minimal privilege scoping to operator role capabilities.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Exploit-DB