CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-8256 – Incorrect Permission Assignment in RutOS based routers and TSWOS based managed switches
https://notcve.org/view.php?id=CVE-2024-8256
10 Dec 2024 — In Teltonika Networks RUTOS devices, running on versions 7.0 to 7.8 (excluding) and TSWOS devices running on versions 1.0 to 1.3 (excluding), due to incorrect permission handling a vulnerability exists which allows a lower privileged user with default permissions to access critical device resources via the API. • https://www.deepcove.support/teltonika-responsible-disclosure-proactive-testing-report • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 9.0EPSS: 0%CPEs: 36EXPL: 0CVE-2023-32350
https://notcve.org/view.php?id=CVE-2023-32350
22 May 2023 — Versions 00.07.00 through 00.07.03 of Teltonika’s RUT router firmware contain an operating system (OS) command injection vulnerability in a Lua service. An attacker could exploit a parameter in the vulnerable function that calls a user-provided package name by instead providing a package with a malicious name that contains an OS command injection payload. • https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 36EXPL: 0CVE-2023-32349
https://notcve.org/view.php?id=CVE-2023-32349
22 May 2023 — Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper validation for filter parameters. However, variables for validation checks are stored in an external configuration file. An authenticated attacker could use an exposed UCI configuration utility to change these variables and enable malicious parameters in the dump utility, which could result in arbitrary code execution. • https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08 • CWE-15: External Control of System or Configuration Setting •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 0CVE-2023-2588
https://notcve.org/view.php?id=CVE-2023-2588
22 May 2023 — Teltonika’s Remote Management System versions prior to 4.10.0 have a feature allowing users to access managed devices’ local secure shell (SSH)/web management services over the cloud proxy. A user can request a web proxy and obtain a URL in the Remote Management System cloud subdomain. This URL could be shared with others without Remote Management System authentication . An attacker could exploit this vulnerability to create a malicious webpage that uses a trusted and certified domain. An attacker could ini... • https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08 • CWE-830: Inclusion of Web Functionality from an Untrusted Source •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-2587
https://notcve.org/view.php?id=CVE-2023-2587
22 May 2023 — Teltonika’s Remote Management System versions prior to 4.10.0 contain a cross-site scripting (XSS) vulnerability in the main page of the web interface. An attacker with the MAC address and serial number of a connected device could send a maliciously crafted JSON file with an HTML object to trigger the vulnerability. This could allow the attacker to execute scripts in the account context and obtain remote code execution on managed devices. • https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 0CVE-2023-2586
https://notcve.org/view.php?id=CVE-2023-2586
22 May 2023 — Teltonika’s Remote Management System versions 4.14.0 is vulnerable to an unauthorized attacker registering previously unregistered devices through the RMS platform. If the user has not disabled the "RMS management feature" enabled by default, then an attacker could register that device to themselves. This could enable the attacker to perform different operations on the user's devices, including remote code execution with 'root' privileges (using the 'Task Manager' feature on RMS). • https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08 • CWE-287: Improper Authentication •
CVSS: 5.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-32348
https://notcve.org/view.php?id=CVE-2023-32348
22 May 2023 — Teltonika’s Remote Management System versions prior to 4.10.0 contain a virtual private network (VPN) hub feature for cross-device communication that uses OpenVPN. It connects new devices in a manner that allows the new device to communicate with all Teltonika devices connected to the VPN. The OpenVPN server also allows users to route through it. An attacker could route a connection to a remote server through the OpenVPN server, enabling them to scan and access data from other Teltonika devices connected to... • https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-32347
https://notcve.org/view.php?id=CVE-2023-32347
22 May 2023 — Teltonika’s Remote Management System versions prior to 4.10.0 use device serial numbers and MAC addresses to identify devices from the user perspective for device claiming and from the device perspective for authentication. If an attacker obtained the serial number and MAC address of a device, they could authenticate as that device and steal communication credentials of the device. This could allow an attacker to enable arbitrary command execution as root by utilizing management options within the newly reg... • https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08 • CWE-287: Improper Authentication •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-32346
https://notcve.org/view.php?id=CVE-2023-32346
22 May 2023 — Teltonika’s Remote Management System versions prior to 4.10.0 contain a function that allows users to claim their devices. This function returns information based on whether the serial number of a device has already been claimed, the MAC address of a device has already been claimed, or whether the attempt to claim a device was successful. An attacker could exploit this to create a list of the serial numbers and MAC addresses of all devices cloud-connected to the Remote Management System. • https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08 • CWE-204: Observable Response Discrepancy •
CVSS: 8.5EPSS: 0%CPEs: 2EXPL: 1CVE-2020-5788
https://notcve.org/view.php?id=CVE-2020-5788
01 Oct 2020 — Relative Path Traversal in Teltonika firmware TRB2_R_00.02.04.3 allows a remote, authenticated attacker to delete arbitrary files on disk via the admin/system/admin/certificates/delete action. Un Salto de Ruta Relativa en el firmware de Teltonika versión TRB2_R_00.02.04.3, permite a un atacante autenticado y remoto eliminar archivos arbitrarios en el disco por medio de la acción admin/system/admin/certificate/delete • https://www.tenable.com/security/research/tra-2020-57 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •