Skip to content
CVE PROGRAM SOURCE RECORD8.4 High

CVE-2026-8914

Command injection in Profile change function

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
tlt_net

Description

In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1, due to unsafe calls to an eval function in rpc-profile, a vulnerability exists where a lower privileged user could perform command injection as the root user.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Teltonika Networks RUTOS

Default version status: unaffected

  • 7.22 to ≤ 7.23.2affected

Teltonika Networks TSWOS

Default version status: unaffected

  • 1.09 to ≤ 1.09.1affected

References