CVSS: 8.8EPSS: 0%CPEs: 36EXPL: 0CVE-2023-32350
https://notcve.org/view.php?id=CVE-2023-32350
Versions 00.07.00 through 00.07.03 of Teltonika’s RUT router firmware contain an operating system (OS) command injection vulnerability in a Lua service. An attacker could exploit a parameter in the vulnerable function that calls a user-provided package name by instead providing a package with a malicious name that contains an OS command injection payload. • https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 36EXPL: 0CVE-2023-32349
https://notcve.org/view.php?id=CVE-2023-32349
Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper validation for filter parameters. However, variables for validation checks are stored in an external configuration file. An authenticated attacker could use an exposed UCI configuration utility to change these variables and enable malicious parameters in the dump utility, which could result in arbitrary code execution. • https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08 • CWE-15: External Control of System or Configuration Setting •
CVSS: 8.5EPSS: 0%CPEs: 2EXPL: 1CVE-2020-5788
https://notcve.org/view.php?id=CVE-2020-5788
Relative Path Traversal in Teltonika firmware TRB2_R_00.02.04.3 allows a remote, authenticated attacker to delete arbitrary files on disk via the admin/system/admin/certificates/delete action. Un Salto de Ruta Relativa en el firmware de Teltonika versión TRB2_R_00.02.04.3, permite a un atacante autenticado y remoto eliminar archivos arbitrarios en el disco por medio de la acción admin/system/admin/certificate/delete • https://www.tenable.com/security/research/tra-2020-57 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.5EPSS: 0%CPEs: 2EXPL: 1CVE-2020-5787
https://notcve.org/view.php?id=CVE-2020-5787
Relative Path Traversal in Teltonika firmware TRB2_R_00.02.04.3 allows a remote, authenticated attacker to delete arbitrary files on disk via the admin/services/packages/remove action. Un Salto de Ruta Relativa en el firmware de Teltonika versión TRB2_R_00.02.04.3, permite a un atacante autenticado y remoto eliminar archivos arbitrarios en el disco por medio de la acción admin/services/packages/remove • https://www.tenable.com/security/research/tra-2020-57 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1CVE-2020-5785
https://notcve.org/view.php?id=CVE-2020-5785
Insufficient output sanitization in Teltonika firmware TRB2_R_00.02.04.3 allows an unauthenticated attacker to conduct reflected cross-site scripting via a crafted ‘action’ or ‘pkg_name’ parameter. Un saneamiento de salida insuficiente en el firmware de Teltonika TRB2_R_00.02.04.3, permite a un atacante no autenticado llevar a cabo un ataque de tipo cross-site scripting por medio del parámetro "action" o "pkg_name" diseñado • https://www.tenable.com/security/research/tra-2020-57 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •