CVE-2026-82104: Teltonika Networks RUT, заобикаляне на вход и права

Описание

Оригинално описание

In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to those requests not following proper flows, this could lead to OS command execution. This issue affects RUT: from 7.22 through 7.24.2; RUTX: from 7.22 through 7.24.2; RUTM: from 7.22 through 7.24.2; RUTC: from 7.22 through 7.24.2; ATRM: from 7.22 through 7.24.2; TAP: from 7.22 through 7.24.2; CAP: from 7.22 through 7.24.2; OXA: from 7.22 through 7.24.2; DAP: from 7.22 through 7.24.2; TRB: from 7.22 through 7.24.2; OTD: from 7.22 through 7.24.2; EBG: from 7.22 through 7.24.2; SWM: from 1.9 through 1.10; TSW: from 1.9 through 1.10.

Засегнати продукти

• Teltonika Networks RUT: 7.22 до 7.24.2
• Teltonika Networks RUTX: 7.22 до 7.24.2
• Teltonika Networks RUTM: 7.22 до 7.24.2
• Teltonika Networks RUTC: 7.22 до 7.24.2
• Teltonika Networks ATRM: 7.22 до 7.24.2
• Teltonika Networks TAP: 7.22 до 7.24.2
• Teltonika Networks CAP: 7.22 до 7.24.2
• Teltonika Networks OXA: 7.22 до 7.24.2
• Teltonika Networks DAP: 7.22 до 7.24.2
• Teltonika Networks TRB: 7.22 до 7.24.2
• Teltonika Networks OTD: 7.22 до 7.24.2
• Teltonika Networks EBG: 7.22 до 7.24.2
• Teltonika Networks SWM: 1.9 до 1.10
• Teltonika Networks TSW: 1.9 до 1.10

Вид слабост

• CWE-306 Липсваща автентикация за критична функционалност

История

Други уязвимости в Teltonika Networks RUT

• 8.5CVE-2026-75826

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-82104
• https://nvd.nist.gov/vuln/detail/CVE-2026-82104
• https://www.teltonika-networks.com/support/security-centre?report=CVE-2026-82104