CVE-2026-82104

API permission bypass via logic bug

Published Oct 30, 2026 CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Description
In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to those requests not following proper flows, this could lead to OS command execution.



This issue affects RUT: from 7.22 through 7.24.2; RUTX: from 7.22 through 7.24.2; RUTM: from 7.22 through 7.24.2; RUTC: from 7.22 through 7.24.2; ATRM: from 7.22 through 7.24.2; TAP: from 7.22 through 7.24.2; CAP: from 7.22 through 7.24.2; OXA: from 7.22 through 7.24.2; DAP: from 7.22 through 7.24.2; TRB: from 7.22 through 7.24.2; OTD: from 7.22 through 7.24.2; EBG: from 7.22 through 7.24.2; SWM: from 1.9 through 1.10; TSW: from 1.9 through 1.10.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Teltonika-networks
Teltonika-networks atrm
Teltonika-networks cap
Teltonika-networks dap
Teltonika-networks ebg
Teltonika-networks otd
Teltonika-networks oxa
Teltonika-networks rut
Teltonika-networks rutc
Teltonika-networks rutm
Teltonika-networks rutx
Teltonika-networks swm
Teltonika-networks tap
Teltonika-networks trb
Teltonika-networks tsw
Vendors & Products Teltonika-networks
Teltonika-networks atrm
Teltonika-networks cap
Teltonika-networks dap
Teltonika-networks ebg
Teltonika-networks otd
Teltonika-networks oxa
Teltonika-networks rut
Teltonika-networks rutc
Teltonika-networks rutm
Teltonika-networks rutx
Teltonika-networks swm
Teltonika-networks tap
Teltonika-networks trb
Teltonika-networks tsw
Type Values Removed Values Added
Weaknesses CWE-284
CWE-78
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
Weaknesses CWE-306
Type Values Removed Values Added
Weaknesses CWE-284
CWE-78
Type Values Removed Values Added
Description In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to those requests not following proper flows, this could lead to OS command execution. This issue affects RUT: from 7.22 through 7.24.2; RUTX: from 7.22 through 7.24.2; RUTM: from 7.22 through 7.24.2; RUTC: from 7.22 through 7.24.2; ATRM: from 7.22 through 7.24.2; TAP: from 7.22 through 7.24.2; CAP: from 7.22 through 7.24.2; OXA: from 7.22 through 7.24.2; DAP: from 7.22 through 7.24.2; TRB: from 7.22 through 7.24.2; OTD: from 7.22 through 7.24.2; EBG: from 7.22 through 7.24.2; SWM: from 1.9 through 1.10; TSW: from 1.9 through 1.10.
Title API permission bypass via logic bug
References
Metrics cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
tlt_net
Published
Updated
Oct 30, 2026, 4:57 PM
Reserved
Aug 28, 2026, 5:06 AM
Status
Awaiting Analysis
Published
Oct 30, 2026, 8:17 AM
Modified
Oct 30, 2026, 5:45 PM