CVE-2026-82104
Full vulnerability record from the local CVENow database.
Description
In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to those requests not following proper flows, this could lead to OS command execution. This issue affects RUT: from 7.22 through 7.24.2; RUTX: from 7.22 through 7.24.2; RUTM: from 7.22 through 7.24.2; RUTC: from 7.22 through 7.24.2; ATRM: from 7.22 through 7.24.2; TAP: from 7.22 through 7.24.2; CAP: from 7.22 through 7.24.2; OXA: from 7.22 through 7.24.2; DAP: from 7.22 through 7.24.2; TRB: from 7.22 through 7.24.2; OTD: from 7.22 through 7.24.2; EBG: from 7.22 through 7.24.2; SWM: from 1.9 through 1.10; TSW: from 1.9 through 1.10.
Severity
CRITICAL
CVSS score
9.4
(v4.0)
Vulnerability status
Received
Source identifier
001d69cf-3fc9-4203-93fb-9865b54e05b2
Published
2026-10-30 08:17:00.240000
Last modified
2026-10-30 08:17:00.240000
View original CVE JSON
{
"id": "CVE-2026-82104",
"sourceIdentifier": "001d69cf-3fc9-4203-93fb-9865b54e05b2",
"published": "2026-10-30T08:17:00.240",
"lastModified": "2026-10-30T08:17:00.240",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to those requests not following proper flows, this could lead to OS command execution.\n\n\n\nThis issue affects RUT: from 7.22 through 7.24.2; RUTX: from 7.22 through 7.24.2; RUTM: from 7.22 through 7.24.2; RUTC: from 7.22 through 7.24.2; ATRM: from 7.22 through 7.24.2; TAP: from 7.22 through 7.24.2; CAP: from 7.22 through 7.24.2; OXA: from 7.22 through 7.24.2; DAP: from 7.22 through 7.24.2; TRB: from 7.22 through 7.24.2; OTD: from 7.22 through 7.24.2; EBG: from 7.22 through 7.24.2; SWM: from 1.9 through 1.10; TSW: from 1.9 through 1.10."
}
],
"affected": [
{
"source": "001d69cf-3fc9-4203-93fb-9865b54e05b2",
"affectedData": [
{
"vendor": "Teltonika Networks",
"product": "RUT",
"defaultStatus": "unaffected",
"versions": [
{
"version": "7.22",
"lessThanOrEqual": "7.24.2",
"versionType": "RUT",
"status": "affected"
}
]
},
{
"vendor": "Teltonika Networks",
"product": "RUTX",
"defaultStatus": "unaffected",
"versions": [
{
"version": "7.22",
"lessThanOrEqual": "7.24.2",
"versionType": "RUTX",
"status": "affected"
}
]
},
{
"vendor": "Teltonika Networks",
"product": "RUTM",
"defaultStatus": "unaffected",
"versions": [
{
"version": "7.22",
"lessThanOrEqual": "7.24.2",
"versionType": "RUTM",
"status": "affected"
}
]
},
{
"vendor": "Teltonika Networks",
"product": "RUTC",
"defaultStatus": "unaffected",
"versions": [
{
"version": "7.22",
"lessThanOrEqual": "7.24.2",
"versionType": "RUTC",
"status": "affected"
}
]
},
{
"vendor": "Teltonika Networks",
"product": "ATRM",
"defaultStatus": "unaffected",
"versions": [
{
"version": "7.22",
"lessThanOrEqual": "7.24.2",
"versionType": "ATRM",
"status": "affected"
}
]
},
{
"vendor": "Teltonika Networks",
"product": "TAP",
"defaultStatus": "unaffected",
"versions": [
{
"version": "7.22",
"lessThanOrEqual": "7.24.2",
"versionType": "TAP",
"status": "affected"
}
]
},
{
"vendor": "Teltonika Networks",
"product": "CAP",
"defaultStatus": "unaffected",
"versions": [
{
"version": "7.22",
"lessThanOrEqual": "7.24.2",
"versionType": "CAP",
"status": "affected"
}
]
},
{
"vendor": "Teltonika Networks",
"product": "OXA",
"defaultStatus": "unaffected",
"versions": [
{
"version": "7.22",
"lessThanOrEqual": "7.24.2",
"versionType": "OXA",
"status": "affected"
}
]
},
{
"vendor": "Teltonika Networks",
"product": "DAP",
"defaultStatus": "unaffected",
"versions": [
{
"version": "7.22",
"lessThanOrEqual": "7.24.2",
"versionType": "DAP",
"status": "affected"
}
]
},
{
"vendor": "Teltonika Networks",
"product": "TRB",
"defaultStatus": "unaffected",
"versions": [
{
"version": "7.22",
"lessThanOrEqual": "7.24.2",
"versionType": "TRB",
"status": "affected"
}
]
},
{
"vendor": "Teltonika Networks",
"product": "OTD",
"defaultStatus": "unaffected",
"versions": [
{
"version": "7.22",
"lessThanOrEqual": "7.24.2",
"versionType": "OTD",
"status": "affected"
}
]
},
{
"vendor": "Teltonika Networks",
"product": "EBG",
"defaultStatus": "unaffected",
"versions": [
{
"version": "7.22",
"lessThanOrEqual": "7.24.2",
"versionType": "EBG",
"status": "affected"
}
]
},
{
"vendor": "Teltonika Networks",
"product": "SWM",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1.9",
"lessThanOrEqual": "1.10",
"versionType": "SWM",
"status": "affected"
}
]
},
{
"vendor": "Teltonika Networks",
"product": "TSW",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1.9",
"lessThanOrEqual": "1.10",
"versionType": "TSW",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "001d69cf-3fc9-4203-93fb-9865b54e05b2",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"attackVector": "ADJACENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
]
},
"references": [
{
"url": "https://www.teltonika-networks.com/support/security-centre?report=CVE-2026-82104",
"source": "001d69cf-3fc9-4203-93fb-9865b54e05b2"
}
]
}