API permission bypass via logic bug
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Teltonika Networks | RUT | unaffected |
|
||||||
| Teltonika Networks | RUTX | unaffected |
|
||||||
| Teltonika Networks | RUTM | unaffected |
|
||||||
| Teltonika Networks | RUTC | unaffected |
|
||||||
| Teltonika Networks | ATRM | unaffected |
|
||||||
| Teltonika Networks | TAP | unaffected |
|
||||||
| Teltonika Networks | CAP | unaffected |
|
||||||
| Teltonika Networks | OXA | unaffected |
|
||||||
| Teltonika Networks | DAP | unaffected |
|
||||||
| Teltonika Networks | TRB | unaffected |
|
||||||
| Teltonika Networks | OTD | unaffected |
|
||||||
| Teltonika Networks | EBG | unaffected |
|
||||||
| Teltonika Networks | SWM | unaffected |
|
||||||
| Teltonika Networks | TSW | unaffected |
|
No data.
No data.
| Vendor | Product | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Teltonika-networks | Atrm |
|
||||||||
| Teltonika-networks | Cap |
|
||||||||
| Teltonika-networks | Dap |
|
||||||||
| Teltonika-networks | Ebg |
|
||||||||
| Teltonika-networks | Otd |
|
||||||||
| Teltonika-networks | Oxa |
|
||||||||
| Teltonika-networks | Rut |
|
||||||||
| Teltonika-networks | Rutc |
|
||||||||
| Teltonika-networks | Rutm |
|
||||||||
| Teltonika-networks | Rutx |
|
||||||||
| Teltonika-networks | Swm |
|
||||||||
| Teltonika-networks | Tap |
|
||||||||
| Teltonika-networks | Trb |
|
||||||||
| Teltonika-networks | Tsw |
|
No CVSS v3.1
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.389% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Teltonika-networks
Teltonika-networks atrm Teltonika-networks cap Teltonika-networks dap Teltonika-networks ebg Teltonika-networks otd Teltonika-networks oxa Teltonika-networks rut Teltonika-networks rutc Teltonika-networks rutm Teltonika-networks rutx Teltonika-networks swm Teltonika-networks tap Teltonika-networks trb Teltonika-networks tsw |
|
| Vendors & Products |
Teltonika-networks
Teltonika-networks atrm Teltonika-networks cap Teltonika-networks dap Teltonika-networks ebg Teltonika-networks otd Teltonika-networks oxa Teltonika-networks rut Teltonika-networks rutc Teltonika-networks rutm Teltonika-networks rutx Teltonika-networks swm Teltonika-networks tap Teltonika-networks trb Teltonika-networks tsw |
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-284 CWE-78 |
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-306 |
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-284 CWE-78 |
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to those requests not following proper flows, this could lead to OS command execution. This issue affects RUT: from 7.22 through 7.24.2; RUTX: from 7.22 through 7.24.2; RUTM: from 7.22 through 7.24.2; RUTC: from 7.22 through 7.24.2; ATRM: from 7.22 through 7.24.2; TAP: from 7.22 through 7.24.2; CAP: from 7.22 through 7.24.2; OXA: from 7.22 through 7.24.2; DAP: from 7.22 through 7.24.2; TRB: from 7.22 through 7.24.2; OTD: from 7.22 through 7.24.2; EBG: from 7.22 through 7.24.2; SWM: from 1.9 through 1.10; TSW: from 1.9 through 1.10. | |
| Title | API permission bypass via logic bug | |
| References |
| |
| Metrics |
cvssV4_0
|