Read the docs
TI-2023-02416 Aliases CVE-2023-2586GHSA-px38-8qpq-6gcq

Improper authentication in Teltonika Remote Management System

Priority MEDIUM 45CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

Teltonika’s Remote Management System versions 4.14.0 is vulnerable to an unauthorized attacker registering previously unregistered devices through the RMS platform. If the user has not disabled the "RMS management feature" enabled by default, then an attacker could register that device to themselves. This could enable the attacker to perform different operations on the user's devices, including remote code execution with 'root' privileges (using the 'Task Manager' feature on RMS).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01023 63rd percentileScored 2026-11-07
Fix Fixed Remote Management System (Teltonika): 4.14.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TeltonikaRemote Management Systembefore 4.14.04.14.0Patch availableCNA
  • Remote Management System VendorTeltonika Affected before 4.14.0 Fixed in 4.14.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:teltonika:remote_management_system:4.14.0:*:*:*:*:*:*:*4.14.0VulnerableTeltonika
  • cpe:2.3:a:teltonika:remote_management_system:4.14.0:*:*:*:*:*:*:* Versions 4.14.0 Vulnerable ·Teltonika

Remediation

  • Fix · CNA Remote Management System (Teltonika) Fixed in 4.14.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-2586
  2. 2026-10-03 Alias added: GHSA-px38-8qpq-6gcq

References

Advisory 1

  • TI-2023-15638 Improper authentication in Teltonika Remote Management System CVSS 3.1CRITICAL 9.8
  • TI-2023-02418 Teltonika’s Remote Management System versions prior to 4.10.0 have a feature allowing… CVSS 3.1HIGH 8.8
  • TI-2023-02417 Cross-site scripting in Teltonika Remote Management System CVSS 3.1HIGH 8.3
  • TI-2023-15639 Server-side request forgery in Teltonika Remote Management System CVSS 3.1MEDIUM 5.8
  • TI-2023-15637 Teltonika’s Remote Management System versions prior to 4.10.0 contain a function that… CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences