Tswos
Monthly
Command injection in the backup function of Teltonika Networks RUTOS and TSWOS allows an attacker who already holds high-privilege administrative access on an adjacent network segment to execute arbitrary OS commands on the device. Affected builds are RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 on RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD and EBG devices, RUTOS 7.22 before 7.25.2 on TAP devices, and TSWOS 1.9 before 1.10.4 on TSW and SWM devices. No public exploit has been identified at time of analysis, and the assessed prerequisites (PR:H for administrator credentials plus AV:A for management-plane adjacency) mean exploitation is not reachable by an arbitrary internet attacker; patched firmware is available.
Privilege escalation via eval-based command injection in Teltonika Networks RUTOS (7.22-7.23.2) and TSWOS (1.09-1.09.1) allows an authenticated lower-privileged operator to execute arbitrary commands as root through the rpc-profile component. The flaw stems from unsafe evaluation of user-controllable input in a Lua/UCI RPC handler and is constrained to local/management-plane access, with no public exploit identified at time of analysis. The CVSS 4.0 score of 8.4 reflects total host compromise once a low-tier admin account is obtained on the device.
Command injection in the backup function of Teltonika Networks RUTOS and TSWOS allows an attacker who already holds high-privilege administrative access on an adjacent network segment to execute arbitrary OS commands on the device. Affected builds are RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 on RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD and EBG devices, RUTOS 7.22 before 7.25.2 on TAP devices, and TSWOS 1.9 before 1.10.4 on TSW and SWM devices. No public exploit has been identified at time of analysis, and the assessed prerequisites (PR:H for administrator credentials plus AV:A for management-plane adjacency) mean exploitation is not reachable by an arbitrary internet attacker; patched firmware is available.
Privilege escalation via eval-based command injection in Teltonika Networks RUTOS (7.22-7.23.2) and TSWOS (1.09-1.09.1) allows an authenticated lower-privileged operator to execute arbitrary commands as root through the rpc-profile component. The flaw stems from unsafe evaluation of user-controllable input in a Lua/UCI RPC handler and is constrained to local/management-plane access, with no public exploit identified at time of analysis. The CVSS 4.0 score of 8.4 reflects total host compromise once a low-tier admin account is obtained on the device.