Description
In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to those requests not following proper flows, this could lead to OS command execution. This issue affects RUT: from 7.22 through 7.24.2; RUTX: from 7.22 through 7.24.2; RUTM: from 7.22 through 7.24.2; RUTC: from 7.22 through 7.24.2; ATRM: from 7.22 through 7.24.2; TAP: from 7.22 through 7.24.2; CAP: from 7.22 through 7.24.2; OXA: from 7.22 through 7.24.2; DAP: from 7.22 through 7.24.2; TRB: from 7.22 through 7.24.2; OTD: from 7.22 through 7.24.2; EBG: from 7.22 through 7.24.2; SWM: from 1.9 through 1.10; TSW: from 1.9 through 1.10.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Teltonika Networks RUT
Default version status: unaffected
7.22 to ≤ 7.24.2affected
Teltonika Networks RUTX
Default version status: unaffected
7.22 to ≤ 7.24.2affected
Teltonika Networks RUTM
Default version status: unaffected
7.22 to ≤ 7.24.2affected
Teltonika Networks RUTC
Default version status: unaffected
7.22 to ≤ 7.24.2affected
Teltonika Networks ATRM
Default version status: unaffected
7.22 to ≤ 7.24.2affected
Teltonika Networks TAP
Default version status: unaffected
7.22 to ≤ 7.24.2affected
Teltonika Networks CAP
Default version status: unaffected
7.22 to ≤ 7.24.2affected
Teltonika Networks OXA
Default version status: unaffected
7.22 to ≤ 7.24.2affected
Teltonika Networks DAP
Default version status: unaffected
7.22 to ≤ 7.24.2affected
Teltonika Networks TRB
Default version status: unaffected
7.22 to ≤ 7.24.2affected
Teltonika Networks OTD
Default version status: unaffected
7.22 to ≤ 7.24.2affected
Teltonika Networks EBG
Default version status: unaffected
7.22 to ≤ 7.24.2affected
Teltonika Networks SWM
Default version status: unaffected
1.9 to ≤ 1.10affected
Teltonika Networks TSW
Default version status: unaffected
1.9 to ≤ 1.10affected