Teltonika RUTOS EUVD-2026-98316

Exploitation requires the attacker to (1) hold HIGH-privilege authenticated access (administrator account) to the device web/management interface, and (2) have ADJACENT network access to that interface (same LAN or management segment per AV:A), not arbitrary internet reachability. The specific trigger is the device BACKUP function, where attacker-controlled input is passed to an OS shell without sanitization. Limiting factors that reduce real-world risk: the PR:H requirement means an attacker must already be authenticated as admin, and AV:A means the management plane must be reachable from the attacker's network segment. Affected only on RUTOS 7.22-before 7.24.6 and 7.25-before 7.25.2 (RUT/RUTX/RUTM/RUTC/ATRM/CAP/OXA/DAP/TRB/OTD/EBG), RUTOS 7.22-before 7.25.2 (TAP), and TSWOS 1.9-before 1.10.4 (TSW/SWM); upgrading past these versions removes the condition.

This is a command injection flaw (CWE-78) in the backup function of Teltonika Networks RUTOS/TSWOS devices. The provided CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:H/UI:N, VC/VI/VA:H) scores 8.5 (High), and the metrics tell a more nuanced story than the raw score: exploitation requires HIGH privileges (PR:H - i.e. an already-authenticated administrator) and ADJACENT network access (AV:A), not open internet reachability. Note a CONFLICT in the source data: the description states a 'remote authenticated attacker,' but the CVSS vector specifies AV:A (adjacent/local network), not AV:N (network) - defenders should treat this as adjacent-network exploitation (same LAN/management segment) rather than fully internet-remote until the vendor clarifies. No EPSS score, no CISA KEV listing, and no POC were provided, so there is no evidence of active or probable exploitation - this is currently a priority driven by impact severity (full C/I/A on the device) rather than by demonstrated exploitability. In practical terms, the PR:H requirement means an attacker must already hold admin credentials, which substantially downgrades real-world risk versus an unauthenticated RCE; the primary threat models are a malicious/compromised low-trust admin escalating to OS-level code execution, or credential compromise on the management network. The vulnerability was reported by Teltonika itself (tlt_net), and patches are available, so this is a patch-management priority rather than an emergency.

An attacker with valid administrative credentials and access to the device's management network (adjacent, not necessarily internet-facing) crafts a malicious parameter in the device backup function that is passed unsanitized to a shell, injecting arbitrary OS commands. Successful exploitation yields full command execution on the underlying RUTOS/TSWOS system, enabling complete device takeover. No public exploit identified at time of analysis.