Command injection in Teltonika RUTOS backup function
Key facts
- Attack vector
- Adjacent network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 on RUT, RUTX, RUTM, RUTC, ATRM and other models, RUTOS 7.22 before 7.25.2 on TAP devices, and TSWOS 1.9 before 1.10.4 on TSW and SWM devices are affected. Insufficient neutralization of special elements (CWE-78) lets user input in the backup function reach OS commands. A remote attacker with high privileges can execute arbitrary OS commands.
Written with Claude Haiku 5.5 from the sources below · 2026-10-27
Description from the CNA
Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 before 1.10.4 (TSW and SWM devices) allows a remote authenticated attacker to execute arbitrary OS commands.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Teltonika Networks | RUT | 7.22 to before 7.24.6 | 7.24.6 | Patch available | CNA |
| Teltonika Networks | RUTX | 7.22 to before 7.24.6; 7.22 to before 7.25.2 | 7.24.6, 7.25.2 | Patch available | CNA |
| Teltonika Networks | RUTM | 7.22 to before 7.24.6; 7.22 to before 7.25.2 | 7.24.6, 7.25.2 | Patch available | CNA |
| Teltonika Networks | RUTC | 7.22 to before 7.24.6 | 7.24.6 | Patch available | CNA |
| Teltonika Networks | ATRM | 7.22 to before 7.24.6 | 7.24.6 | Patch available | CNA |
| Teltonika Networks | TAP | 7.22 to before 7.25.2 | 7.25.2 | Patch available | CNA |
| Teltonika Networks | CAP | 7.22 to before 7.24.6 | 7.24.6 | Patch available | CNA |
| Teltonika Networks | OXA | 7.22 to before 7.24.6 | 7.24.6 | Patch available | CNA |
| Teltonika Networks | DAP | 7.22 to before 7.24.6 | 7.24.6 | Patch available | CNA |
| Teltonika Networks | TRB | 7.22 to before 7.24.6 | 7.24.6 | Patch available | CNA |
| Teltonika Networks | OTD | 7.22 to before 7.24.6 | 7.24.6 | Patch available | CNA |
| Teltonika Networks | EBG | 7.22 to before 7.24.6 | 7.24.6 | Patch available | CNA |
| Teltonika Networks | SWM | 1.9 to before 1.10.4 | 1.10.4 | Patch available | CNA |
| Teltonika Networks | TSW | 1.9 to before 1.10.4 | 1.10.4 | Patch available | CNA |
- RUT VendorTeltonika Networks Affected 7.22 to before 7.24.6 Fixed in 7.24.6 Patch available CNA
- RUTX VendorTeltonika Networks Affected 7.22 to before 7.24.6; 7.22 to before 7.25.2 Fixed in 7.24.6, 7.25.2 Patch available CNA
- RUTM VendorTeltonika Networks Affected 7.22 to before 7.24.6; 7.22 to before 7.25.2 Fixed in 7.24.6, 7.25.2 Patch available CNA
- RUTC VendorTeltonika Networks Affected 7.22 to before 7.24.6 Fixed in 7.24.6 Patch available CNA
- ATRM VendorTeltonika Networks Affected 7.22 to before 7.24.6 Fixed in 7.24.6 Patch available CNA
- TAP VendorTeltonika Networks Affected 7.22 to before 7.25.2 Fixed in 7.25.2 Patch available CNA
- CAP VendorTeltonika Networks Affected 7.22 to before 7.24.6 Fixed in 7.24.6 Patch available CNA
- OXA VendorTeltonika Networks Affected 7.22 to before 7.24.6 Fixed in 7.24.6 Patch available CNA
- DAP VendorTeltonika Networks Affected 7.22 to before 7.24.6 Fixed in 7.24.6 Patch available CNA
- TRB VendorTeltonika Networks Affected 7.22 to before 7.24.6 Fixed in 7.24.6 Patch available CNA
- OTD VendorTeltonika Networks Affected 7.22 to before 7.24.6 Fixed in 7.24.6 Patch available CNA
- EBG VendorTeltonika Networks Affected 7.22 to before 7.24.6 Fixed in 7.24.6 Patch available CNA
- SWM VendorTeltonika Networks Affected 1.9 to before 1.10.4 Fixed in 1.10.4 Patch available CNA
- TSW VendorTeltonika Networks Affected 1.9 to before 1.10.4 Fixed in 1.10.4 Patch available CNA
Remediation
Fixed in RUTOS 7.24.6 for RUT, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD and EBG devices, in RUTOS 7.24.6 and 7.25.2 for RUTX and RUTM, in RUTOS 7.25.2 for TAP devices, and in TSWOS 1.10.4 for TSW and SWM devices.
Written with Claude Haiku 5.5 from the sources below · 2026-10-27
- Fix · CNA RUT (Teltonika Networks) Fixed in 7.24.6
- Fix · CNA RUTX (Teltonika Networks) Fixed in 7.24.6, 7.25.2
- Fix · CNA RUTM (Teltonika Networks) Fixed in 7.24.6, 7.25.2
- Fix · CNA RUTC (Teltonika Networks) Fixed in 7.24.6
- Fix · CNA ATRM (Teltonika Networks) Fixed in 7.24.6
- Fix · CNA TAP (Teltonika Networks) Fixed in 7.25.2
- Fix · CNA CAP (Teltonika Networks) Fixed in 7.24.6
- Fix · CNA OXA (Teltonika Networks) Fixed in 7.24.6
- Fix · CNA DAP (Teltonika Networks) Fixed in 7.24.6
- Fix · CNA TRB (Teltonika Networks) Fixed in 7.24.6
- Fix · CNA OTD (Teltonika Networks) Fixed in 7.24.6
- Fix · CNA EBG (Teltonika Networks) Fixed in 7.24.6
- Fix · CNA SWM (Teltonika Networks) Fixed in 1.10.4
- Fix · CNA TSW (Teltonika Networks) Fixed in 1.10.4
Timeline
- 2026-10-13 Threatist record created from CVE-2026-75826
- 2026-10-13 Fix available: Teltonika Networks/[email protected], Teltonika Networks/[email protected], Teltonika Networks/[email protected] +13 · CNA
- 2026-10-13 Alias added: GHSA-xpq3-gmf3-hrp3
- 2026-10-13 Priority changed: MEDIUM → LOW
- 2026-10-15 CISA SSVC decision points changed
- 2026-10-15 Priority changed: LOW → MEDIUM
More Teltonika Networks vulnerabilities
- TI-2025-04185 Account pre-hijacking through invite misuse CVSS 4.0HIGH 7.2
- TI-2023-15193 Teltonika RUT240 devices with firmware before 07.04.2, when bridge mode is used… CVSS 3.1HIGH 7.0
- TI-2024-07654 Incorrect Permission Assignment in RutOS based routers and TSWOS based managed switches CVSS 4.0MEDIUM 5.9
- TI-2020-04714 Cross-site request forgery in Teltonika Gateway TRB245 CVSS 3.1HIGH 8.8
- TI-2026-82959 Teltonika RUTOS API flaw lets unauthenticated users run OS commands CVSS 4.0CRITICAL 9.4
- TI-2023-15641 OS command injection in Teltonika RUT model routers CVSS 3.1HIGH 8.8
Sources
- CVE-2026-75826 · CVE Program
- CVE-2026-75826 · NVD
- FIRST EPSS
- GHSA-xpq3-gmf3-hrp3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences