Versions 00.07.00 through 00.07.03 of Teltonika’s RUT router firmware contain an operating system (OS) command injection vulnerability in a Lua service. An attacker could exploit a parameter in the vulnerable function that calls a user-provided package name by instead providing a package with a malicious name that contains an OS command injection payload.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00294.

Exploitation none

Automatable no

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Teltonika RUT model routers unaffected
Version Status Constraints
00.07.00 affected ≤ 00.07.03

Configuration 1 [-]

AND
cpe:2.3:o:teltonika-networks:rut200_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rut200:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND
cpe:2.3:o:teltonika-networks:rut240_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rut240:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND
cpe:2.3:o:teltonika-networks:rut241_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rut241:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND
cpe:2.3:o:teltonika-networks:rut300_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rut300:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND
cpe:2.3:o:teltonika-networks:rut360_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rut360:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND
cpe:2.3:o:teltonika-networks:rut901_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rut901:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND
cpe:2.3:o:teltonika-networks:rut950_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rut950:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND
cpe:2.3:o:teltonika-networks:rut951_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rut951:-:*:*:*:*:*:*:*

Configuration 9 [-]

AND
cpe:2.3:o:teltonika-networks:rut955_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rut955:-:*:*:*:*:*:*:*

Configuration 10 [-]

AND
cpe:2.3:o:teltonika-networks:rut956_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rut956:-:*:*:*:*:*:*:*

Configuration 11 [-]

AND
cpe:2.3:o:teltonika-networks:rutx08_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rutx08:-:*:*:*:*:*:*:*

Configuration 12 [-]

AND
cpe:2.3:o:teltonika-networks:rutx09_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rutx09:-:*:*:*:*:*:*:*

Configuration 13 [-]

AND
cpe:2.3:o:teltonika-networks:rutx10_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rutx10:-:*:*:*:*:*:*:*

Configuration 14 [-]

AND
cpe:2.3:o:teltonika-networks:rutx11_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rutx11:-:*:*:*:*:*:*:*

Configuration 15 [-]

AND
cpe:2.3:o:teltonika-networks:rutx12_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rutx12:-:*:*:*:*:*:*:*

Configuration 16 [-]

AND
cpe:2.3:o:teltonika-networks:rutx14_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rutx14:-:*:*:*:*:*:*:*

Configuration 17 [-]

AND
cpe:2.3:o:teltonika-networks:rutx50_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rutx50:-:*:*:*:*:*:*:*

Configuration 18 [-]

AND
cpe:2.3:o:teltonika-networks:rutxr1_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:teltonika-networks:rutxr1:-:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Teltonika-networks Subscribe
Rut200 Subscribe
Rut200 Firmware Subscribe
Rut240 Subscribe
Rut240 Firmware Subscribe
Rut241 Subscribe
Rut241 Firmware Subscribe
Rut300 Subscribe
Rut300 Firmware Subscribe
Rut360 Subscribe
Rut360 Firmware Subscribe
Rut901 Subscribe
Rut901 Firmware Subscribe
Rut950 Subscribe
Rut950 Firmware Subscribe
Rut951 Subscribe
Rut951 Firmware Subscribe
Rut955 Subscribe
Rut955 Firmware Subscribe
Rut956 Subscribe
Rut956 Firmware Subscribe
Rutx08 Subscribe
Rutx08 Firmware Subscribe
Rutx09 Subscribe
Rutx09 Firmware Subscribe
Rutx10 Subscribe
Rutx10 Firmware Subscribe
Rutx11 Subscribe
Rutx11 Firmware Subscribe
Rutx12 Subscribe
Rutx12 Firmware Subscribe
Rutx14 Subscribe
Rutx14 Firmware Subscribe
Rutx50 Subscribe
Rutx50 Firmware Subscribe
Rutxr1 Subscribe
Rutxr1 Firmware Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2023-36594 Versions 00.07.00 through 00.07.03 of Teltonika’s RUT router firmware contain an operating system (OS) command injection vulnerability in a Lua service. An attacker could exploit a parameter in the vulnerable function that calls a user-provided package name by instead providing a package with a malicious name that contains an OS command injection payload.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08 cve-icon cve-icon
History

Fri, 17 Jan 2025 08:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: icscert

Published:

Updated: 2025-01-16T21:34:13.864Z

Reserved: 2023-05-08T22:09:33.450Z

Link: CVE-2023-32350

cve-icon Vulnrichment

Updated: 2024-08-02T15:10:24.899Z

cve-icon NVD

Status : Modified

Published: 2023-05-22T16:15:10.497

Modified: 2024-11-21T08:03:09.873

Link: CVE-2023-32350

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses