Read the docs
TI-2023-02417 Aliases CVE-2023-2587GHSA-mrcv-35v6-xwxf

Cross-site scripting in Teltonika Remote Management System

Priority MEDIUM 40CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Teltonika’s Remote Management System versions prior to 4.10.0 contain a cross-site scripting (XSS) vulnerability in the main page of the web interface. An attacker with the MAC address and serial number of a connected device could send a maliciously crafted JSON file with an HTML object to trigger the vulnerability. This could allow the attacker to execute scripts in the account context and obtain remote code execution on managed devices.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00917 60th percentileScored 2026-11-07
Fix Fixed Remote Management System (Teltonika): 4.10.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TeltonikaRemote Management Systembefore 4.10.04.10.0Patch availableCNA
  • Remote Management System VendorTeltonika Affected before 4.10.0 Fixed in 4.10.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:teltonika:remote_management_system:*:*:*:*:*:*:*:*before 4.10.0VulnerableTeltonika
  • cpe:2.3:a:teltonika:remote_management_system:*:*:*:*:*:*:*:* Versions before 4.10.0 Vulnerable ·Teltonika

Remediation

  • Fix · CNA Remote Management System (Teltonika) Fixed in 4.10.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Teltonika Remote Management System 4.10.0

    5 records Highest priority Priority MEDIUM 3 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2023-15638 Improper authentication in Teltonika Remote Management SystemPriority MEDIUM 43
    • TI-2023-02418 Teltonika’s Remote Management System versions prior to 4.10.0 have a feature allowing…Priority MEDIUM 42
    • TI-2023-15639 Server-side request forgery in Teltonika Remote Management SystemPriority LOW 33
    Show all 5 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-2587
  2. 2026-10-03 Alias added: GHSA-mrcv-35v6-xwxf

References

Advisory 1

  • TI-2023-02416 Improper authentication in Teltonika Remote Management System CVSS 3.1CRITICAL 9.8
  • TI-2023-15638 Improper authentication in Teltonika Remote Management System CVSS 3.1CRITICAL 9.8
  • TI-2023-02418 Teltonika’s Remote Management System versions prior to 4.10.0 have a feature allowing… CVSS 3.1HIGH 8.8
  • TI-2023-15639 Server-side request forgery in Teltonika Remote Management System CVSS 3.1MEDIUM 5.8
  • TI-2023-15637 Teltonika’s Remote Management System versions prior to 4.10.0 contain a function that… CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences