Paper/Archive/CVE-2026-82104

CVE-2026-82104

Teltonika Networks RUT — API permission bypass via logic bug

CVSS 9.4 (CNA)9.4 / 10 × 3028.2 Not in CISA KEV+300.0 No EPSS score.000 × 200.0 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to those requests not following proper flows, this could lead to OS command execution. This issue affects RUT: from 7.22 through 7.24.2; RUTX: from 7.22 through 7.24.2; RUTM: from 7.22 through 7.24.2; RUTC: from 7.22 through 7.24.2; ATRM: from 7.22 through 7.24.2; TAP: from 7.22 through 7.24.2; CAP: from 7.22 through 7.24.2; OXA: from 7.22 through 7.24.2; DAP: from 7.22 through 7.24.2; TRB: from 7.22 through 7.24.2; OTD: from 7.22 through 7.24.2; EBG: from 7.22 through 7.24.2; SWM: from 1.9 through 1.10; TSW: from 1.9 through 1.10.

Affected

ProductAffectedFixed inSource

RUT7.22 – 7.24.2–CNA

RUTX7.22 – 7.24.2–CNA

RUTM7.22 – 7.24.2–CNA

RUTC7.22 – 7.24.2–CNA

ATRM7.22 – 7.24.2–CNA

TAP7.22 – 7.24.2–CNA

CAP7.22 – 7.24.2–CNA

OXA7.22 – 7.24.2–CNA

DAP7.22 – 7.24.2–CNA

TRB7.22 – 7.24.2–CNA

OTD7.22 – 7.24.2–CNA

EBG7.22 – 7.24.2–CNA

Scores by source

tlt_net (CNA)9.4CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

refteltonika-networks.com/support/security-centre?report=CVE-2026-82104