Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper validation for filter parameters. However, variables for validation checks are stored in an external configuration file. An authenticated attacker could use an exposed UCI configuration utility to change these variables and enable malicious parameters in the dump utility, which could result in arbitrary code execution.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00066.

Exploitation none

Automatable no

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Teltonika RUT model routers unaffected
Version Status Constraints
0 affected ≤ 00.07.03.4

Configuration 1 [-]

AND
cpe:2.3:o:teltonika-networks:rut200_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rut200:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND
cpe:2.3:o:teltonika-networks:rut240_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rut240:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND
cpe:2.3:o:teltonika-networks:rut241_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rut241:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND
cpe:2.3:o:teltonika-networks:rut300_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rut300:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND
cpe:2.3:o:teltonika-networks:rut360_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rut360:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND
cpe:2.3:o:teltonika-networks:rut901_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rut901:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND
cpe:2.3:o:teltonika-networks:rut950_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rut950:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND
cpe:2.3:o:teltonika-networks:rut951_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rut951:-:*:*:*:*:*:*:*

Configuration 9 [-]

AND
cpe:2.3:o:teltonika-networks:rut955_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rut955:-:*:*:*:*:*:*:*

Configuration 10 [-]

AND
cpe:2.3:o:teltonika-networks:rut956_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rut956:-:*:*:*:*:*:*:*

Configuration 11 [-]

AND
cpe:2.3:o:teltonika-networks:rutx08_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rutx08:-:*:*:*:*:*:*:*

Configuration 12 [-]

AND
cpe:2.3:o:teltonika-networks:rutx09_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rutx09:-:*:*:*:*:*:*:*

Configuration 13 [-]

AND
cpe:2.3:o:teltonika-networks:rutx10_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rutx10:-:*:*:*:*:*:*:*

Configuration 14 [-]

AND
cpe:2.3:o:teltonika-networks:rutx11_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rutx11:-:*:*:*:*:*:*:*

Configuration 15 [-]

AND
cpe:2.3:o:teltonika-networks:rutx12_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rutx12:-:*:*:*:*:*:*:*

Configuration 16 [-]

AND
cpe:2.3:o:teltonika-networks:rutx14_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rutx14:-:*:*:*:*:*:*:*

Configuration 17 [-]

AND
cpe:2.3:o:teltonika-networks:rutx50_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rutx50:-:*:*:*:*:*:*:*

Configuration 18 [-]

AND
cpe:2.3:o:teltonika-networks:rutxr1_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rutxr1:-:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Teltonika-networks Subscribe
Rut200 Subscribe
Rut200 Firmware Subscribe
Rut240 Subscribe
Rut240 Firmware Subscribe
Rut241 Subscribe
Rut241 Firmware Subscribe
Rut300 Subscribe
Rut300 Firmware Subscribe
Rut360 Subscribe
Rut360 Firmware Subscribe
Rut901 Subscribe
Rut901 Firmware Subscribe
Rut950 Subscribe
Rut950 Firmware Subscribe
Rut951 Subscribe
Rut951 Firmware Subscribe
Rut955 Subscribe
Rut955 Firmware Subscribe
Rut956 Subscribe
Rut956 Firmware Subscribe
Rutx08 Subscribe
Rutx08 Firmware Subscribe
Rutx09 Subscribe
Rutx09 Firmware Subscribe
Rutx10 Subscribe
Rutx10 Firmware Subscribe
Rutx11 Subscribe
Rutx11 Firmware Subscribe
Rutx12 Subscribe
Rutx12 Firmware Subscribe
Rutx14 Subscribe
Rutx14 Firmware Subscribe
Rutx50 Subscribe
Rutx50 Firmware Subscribe
Rutxr1 Subscribe
Rutxr1 Firmware Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2023-36593 Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper validation for filter parameters. However, variables for validation checks are stored in an external configuration file. An authenticated attacker could use an exposed UCI configuration utility to change these variables and enable malicious parameters in the dump utility, which could result in arbitrary code execution.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08 cve-icon cve-icon
History

Thu, 16 Jan 2025 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: icscert

Published:

Updated: 2025-01-16T21:34:23.944Z

Reserved: 2023-05-08T22:09:33.450Z

Link: CVE-2023-32349

cve-icon Vulnrichment

Updated: 2024-08-02T15:10:24.909Z

cve-icon NVD

Status : Modified

Published: 2023-05-22T16:15:10.420

Modified: 2024-11-21T08:03:09.730

Link: CVE-2023-32349

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses