EUVD-2026-57786
GHSA-g34r-6m6v-97g6
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent vector from CVSS 4.0 AV:A; PR:L because a device account is required; admin escalation yields full CIA impact on the device.
Primary rating from Vendor (001d69cf-3fc9-4203-93fb-9865b54e05b2).
CVSS VectorVendor: 001d69cf-3fc9-4203-93fb-9865b54e05b2
Lifecycle Timeline
1DescriptionCVE.org
In Teltonika Networks RUTOS devices running versions 7.07.1 through 7.24.1 and TSWOS devices running versions 1.03 through 1.10, a vulnerability exists whereby a lower privileged user can escalate privileges to administrative level due to unsafe calls to an execl function.
AnalysisAI
Privilege escalation in Teltonika Networks RUTOS (versions 7.07.1-7.24.1) and TSWOS (versions 1.03-1.10) allows an adjacent-network attacker with a low-privileged account to gain full administrative control of the device by exploiting unsafe argument handling in an execl() system call. The vulnerability enables complete integrity compromise of the affected router or switch operating system without requiring elevated privileges at entry. No public exploit code has been identified at time of analysis, and the flaw is not currently listed in the CISA KEV catalog.
Technical ContextAI
The root cause is CWE-93, catalogued as Improper Neutralization of CRLF Sequences, though the described mechanism - unsafe calls to the POSIX execl() function - is more characteristic of argument injection (CWE-88) or improper privilege management (CWE-269). The execl() call replaces the current process image with a new executable; if user-controlled data is passed unsanitized as arguments or as the executable path, an attacker can redirect execution or inject additional command arguments to escalate privileges. RUTOS is Teltonika's Linux-based router operating system deployed on their RUT-series industrial cellular/networking hardware; TSWOS is the counterpart OS for their TSW-series managed switches. The affected CPE scope spans RUTOS 7.07.1 through 7.24.1 and TSWOS 1.03 through 1.10 per the vendor's own security centre advisory. The CWE assignment should be verified against the vendor's advisory, as CWE-93 (CRLF Injection) does not cleanly describe execl()-based privilege escalation - this may indicate a data-quality issue in the NVD submission.
RemediationAI
Upgrade RUTOS firmware to a version above 7.24.1 and TSWOS firmware to a version above 1.10, per the Teltonika security centre advisory at https://www.teltonika-networks.com/support/security-centre?report=CVE-2026-16455. An exact patched release version is not confirmed from available data - contact Teltonika support or monitor the security centre for a confirmed fixed build before upgrading. As a compensating control pending patch availability, restrict low-privileged user accounts to only those strictly necessary and audit existing non-admin accounts on all affected devices; removing unnecessary accounts eliminates the required PR:L entry point entirely. Additionally, enforce strict network segmentation to isolate device management interfaces from untrusted LAN segments, raising the effective attack vector cost from adjacent to physical. Both mitigations reduce exposure but do not eliminate the underlying vulnerability.
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today