Read the docs
TI-2023-15640 Aliases CVE-2023-32349GHSA-mgp4-67w5-r388

Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump…

Priority MEDIUM 42CWE-15Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper validation for filter parameters. However, variables for validation checks are stored in an external configuration file. An authenticated attacker could use an exposed UCI configuration utility to change these variables and enable malicious parameters in the dump utility, which could result in arbitrary code execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01089 65th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TeltonikaRUT model routersup to 00.07.03.4—No fix listedCNA
  • RUT model routers VendorTeltonika Affected up to 00.07.03.4 Fixed in — No fix listed CNA

CPE configurations NVD · 36

CPEVersionsRoleVendor
cpe:2.3:o:teltonika-networks:rut200_firmware:*:*:*:*:*:*:*:*up to 00.07.03.4VulnerableTeltonika Networks
cpe:2.3:h:teltonika-networks:rut200:-:*:*:*:*:*:*:*not specified by NVDRunning onTeltonika Networks
cpe:2.3:o:teltonika-networks:rut240_firmware:*:*:*:*:*:*:*:*up to 00.07.03.4VulnerableTeltonika Networks
cpe:2.3:h:teltonika-networks:rut240:-:*:*:*:*:*:*:*not specified by NVDRunning onTeltonika Networks
cpe:2.3:o:teltonika-networks:rut241_firmware:*:*:*:*:*:*:*:*up to 00.07.03.4VulnerableTeltonika Networks
cpe:2.3:h:teltonika-networks:rut241:-:*:*:*:*:*:*:*not specified by NVDRunning onTeltonika Networks
cpe:2.3:o:teltonika-networks:rut300_firmware:*:*:*:*:*:*:*:*up to 00.07.03.4VulnerableTeltonika Networks
cpe:2.3:h:teltonika-networks:rut300:-:*:*:*:*:*:*:*not specified by NVDRunning onTeltonika Networks
cpe:2.3:o:teltonika-networks:rut360_firmware:*:*:*:*:*:*:*:*up to 00.07.03.4VulnerableTeltonika Networks
cpe:2.3:h:teltonika-networks:rut360:-:*:*:*:*:*:*:*not specified by NVDRunning onTeltonika Networks
  • cpe:2.3:o:teltonika-networks:rut200_firmware:*:*:*:*:*:*:*:* Versions up to 00.07.03.4 Vulnerable ·Teltonika Networks
  • cpe:2.3:h:teltonika-networks:rut200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Teltonika Networks
  • cpe:2.3:o:teltonika-networks:rut240_firmware:*:*:*:*:*:*:*:* Versions up to 00.07.03.4 Vulnerable ·Teltonika Networks
  • cpe:2.3:h:teltonika-networks:rut240:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Teltonika Networks
  • cpe:2.3:o:teltonika-networks:rut241_firmware:*:*:*:*:*:*:*:* Versions up to 00.07.03.4 Vulnerable ·Teltonika Networks
  • cpe:2.3:h:teltonika-networks:rut241:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Teltonika Networks
  • cpe:2.3:o:teltonika-networks:rut300_firmware:*:*:*:*:*:*:*:* Versions up to 00.07.03.4 Vulnerable ·Teltonika Networks
  • cpe:2.3:h:teltonika-networks:rut300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Teltonika Networks
  • cpe:2.3:o:teltonika-networks:rut360_firmware:*:*:*:*:*:*:*:* Versions up to 00.07.03.4 Vulnerable ·Teltonika Networks
  • cpe:2.3:h:teltonika-networks:rut360:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Teltonika Networks
Show 26 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:teltonika-networks:rut901_firmware:*:*:*:*:*:*:*:*up to 00.07.03.4VulnerableTeltonika Networks
cpe:2.3:h:teltonika-networks:rut901:-:*:*:*:*:*:*:*not specified by NVDRunning onTeltonika Networks
cpe:2.3:o:teltonika-networks:rut950_firmware:*:*:*:*:*:*:*:*up to 00.07.03.4VulnerableTeltonika Networks
cpe:2.3:h:teltonika-networks:rut950:-:*:*:*:*:*:*:*not specified by NVDRunning onTeltonika Networks
cpe:2.3:o:teltonika-networks:rut951_firmware:*:*:*:*:*:*:*:*up to 00.07.03.4VulnerableTeltonika Networks
cpe:2.3:h:teltonika-networks:rut951:-:*:*:*:*:*:*:*not specified by NVDRunning onTeltonika Networks
cpe:2.3:o:teltonika-networks:rut955_firmware:*:*:*:*:*:*:*:*up to 00.07.03.4VulnerableTeltonika Networks
cpe:2.3:h:teltonika-networks:rut955:-:*:*:*:*:*:*:*not specified by NVDRunning onTeltonika Networks
cpe:2.3:o:teltonika-networks:rut956_firmware:*:*:*:*:*:*:*:*up to 00.07.03.4VulnerableTeltonika Networks
cpe:2.3:h:teltonika-networks:rut956:-:*:*:*:*:*:*:*not specified by NVDRunning onTeltonika Networks
cpe:2.3:o:teltonika-networks:rutx08_firmware:*:*:*:*:*:*:*:*up to 00.07.03.4VulnerableTeltonika Networks
cpe:2.3:h:teltonika-networks:rutx08:-:*:*:*:*:*:*:*not specified by NVDRunning onTeltonika Networks
cpe:2.3:o:teltonika-networks:rutx09_firmware:*:*:*:*:*:*:*:*up to 00.07.03.4VulnerableTeltonika Networks
cpe:2.3:h:teltonika-networks:rutx09:-:*:*:*:*:*:*:*not specified by NVDRunning onTeltonika Networks
cpe:2.3:o:teltonika-networks:rutx10_firmware:*:*:*:*:*:*:*:*up to 00.07.03.4VulnerableTeltonika Networks
cpe:2.3:h:teltonika-networks:rutx10:-:*:*:*:*:*:*:*not specified by NVDRunning onTeltonika Networks
cpe:2.3:o:teltonika-networks:rutx11_firmware:*:*:*:*:*:*:*:*up to 00.07.03.4VulnerableTeltonika Networks
cpe:2.3:h:teltonika-networks:rutx11:-:*:*:*:*:*:*:*not specified by NVDRunning onTeltonika Networks
cpe:2.3:o:teltonika-networks:rutx12_firmware:*:*:*:*:*:*:*:*up to 00.07.03.4VulnerableTeltonika Networks
cpe:2.3:h:teltonika-networks:rutx12:-:*:*:*:*:*:*:*not specified by NVDRunning onTeltonika Networks
cpe:2.3:o:teltonika-networks:rutx14_firmware:*:*:*:*:*:*:*:*00.07.00 – 00.07.03.4VulnerableTeltonika Networks
cpe:2.3:h:teltonika-networks:rutx14:-:*:*:*:*:*:*:*not specified by NVDRunning onTeltonika Networks
cpe:2.3:o:teltonika-networks:rutx50_firmware:*:*:*:*:*:*:*:*00.07.00 – 00.07.03.4VulnerableTeltonika Networks
cpe:2.3:h:teltonika-networks:rutx50:-:*:*:*:*:*:*:*not specified by NVDRunning onTeltonika Networks
cpe:2.3:o:teltonika-networks:rutxr1_firmware:*:*:*:*:*:*:*:*00.07.00 – 00.07.03.4VulnerableTeltonika Networks
cpe:2.3:h:teltonika-networks:rutxr1:-:*:*:*:*:*:*:*not specified by NVDRunning onTeltonika Networks
  • cpe:2.3:o:teltonika-networks:rut901_firmware:*:*:*:*:*:*:*:* Versions up to 00.07.03.4 Vulnerable ·Teltonika Networks
  • cpe:2.3:h:teltonika-networks:rut901:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Teltonika Networks
  • cpe:2.3:o:teltonika-networks:rut950_firmware:*:*:*:*:*:*:*:* Versions up to 00.07.03.4 Vulnerable ·Teltonika Networks
  • cpe:2.3:h:teltonika-networks:rut950:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Teltonika Networks
  • cpe:2.3:o:teltonika-networks:rut951_firmware:*:*:*:*:*:*:*:* Versions up to 00.07.03.4 Vulnerable ·Teltonika Networks
  • cpe:2.3:h:teltonika-networks:rut951:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Teltonika Networks
  • cpe:2.3:o:teltonika-networks:rut955_firmware:*:*:*:*:*:*:*:* Versions up to 00.07.03.4 Vulnerable ·Teltonika Networks
  • cpe:2.3:h:teltonika-networks:rut955:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Teltonika Networks
  • cpe:2.3:o:teltonika-networks:rut956_firmware:*:*:*:*:*:*:*:* Versions up to 00.07.03.4 Vulnerable ·Teltonika Networks
  • cpe:2.3:h:teltonika-networks:rut956:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Teltonika Networks
  • cpe:2.3:o:teltonika-networks:rutx08_firmware:*:*:*:*:*:*:*:* Versions up to 00.07.03.4 Vulnerable ·Teltonika Networks
  • cpe:2.3:h:teltonika-networks:rutx08:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Teltonika Networks
  • cpe:2.3:o:teltonika-networks:rutx09_firmware:*:*:*:*:*:*:*:* Versions up to 00.07.03.4 Vulnerable ·Teltonika Networks
  • cpe:2.3:h:teltonika-networks:rutx09:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Teltonika Networks
  • cpe:2.3:o:teltonika-networks:rutx10_firmware:*:*:*:*:*:*:*:* Versions up to 00.07.03.4 Vulnerable ·Teltonika Networks
  • cpe:2.3:h:teltonika-networks:rutx10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Teltonika Networks
  • cpe:2.3:o:teltonika-networks:rutx11_firmware:*:*:*:*:*:*:*:* Versions up to 00.07.03.4 Vulnerable ·Teltonika Networks
  • cpe:2.3:h:teltonika-networks:rutx11:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Teltonika Networks
  • cpe:2.3:o:teltonika-networks:rutx12_firmware:*:*:*:*:*:*:*:* Versions up to 00.07.03.4 Vulnerable ·Teltonika Networks
  • cpe:2.3:h:teltonika-networks:rutx12:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Teltonika Networks
  • cpe:2.3:o:teltonika-networks:rutx14_firmware:*:*:*:*:*:*:*:* Versions 00.07.00 – 00.07.03.4 Vulnerable ·Teltonika Networks
  • cpe:2.3:h:teltonika-networks:rutx14:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Teltonika Networks
  • cpe:2.3:o:teltonika-networks:rutx50_firmware:*:*:*:*:*:*:*:* Versions 00.07.00 – 00.07.03.4 Vulnerable ·Teltonika Networks
  • cpe:2.3:h:teltonika-networks:rutx50:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Teltonika Networks
  • cpe:2.3:o:teltonika-networks:rutxr1_firmware:*:*:*:*:*:*:*:* Versions 00.07.00 – 00.07.03.4 Vulnerable ·Teltonika Networks
  • cpe:2.3:h:teltonika-networks:rutxr1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Teltonika Networks

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-32349
  2. 2026-10-03 Alias added: GHSA-mgp4-67w5-r388

References

Advisory 1

  • TI-2018-12492 Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple… CVSS 3.0CRITICAL 9.8
  • TI-2017-05691 The management interface for the Teltonika RUT9XX routers (aka LuCI) with firmware… CVSS 3.0CRITICAL 9.8
  • TI-2023-02416 Improper authentication in Teltonika Remote Management System CVSS 3.1CRITICAL 9.8
  • TI-2018-14083 An issue was discovered in /cgi-bin/luci on Teltonika RTU9XX (e.g., RUT950) R_31.04.89… CVSS 3.0CRITICAL 9.8
  • TI-2023-15641 OS command injection in Teltonika RUT model routers CVSS 3.1HIGH 8.8
  • TI-2023-15638 Improper authentication in Teltonika Remote Management System CVSS 3.1CRITICAL 9.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences