CVEvulnerability
CVE-2017-8116
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2017-07-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-78
Description
The management interface for the Teltonika RUT9XX routers (aka LuCI) with firmware 00.03.265 and earlier allows remote attackers to execute arbitrary commands with root privileges via shell metacharacters in the username parameter in a login request.
Affected configurations
• teltonika rut900 firmware (<= 00.03.265)
• teltonika rut905 firmware (<= 00.03.265)
• teltonika rut950 firmware (<= 00.03.265)
• teltonika rut955 firmware (<= 00.03.265)
Related
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- https://github.com/nettitude/metasploit-modules/blob/master/teltonika_add_user.rb Exploit, Third Party Advisory
- https://github.com/nettitude/metasploit-modules/blob/master/teltonika_cmd_exec.rb Exploit, Third Party Advisory
- https://labs.nettitude.com/blog/cve-2017-8116-teltonika-router-unauthenticated-remote-code-execution/ Third Party Advisory
- https://github.com/nettitude/metasploit-modules/blob/master/teltonika_add_user.rb Exploit, Third Party Advisory
- https://github.com/nettitude/metasploit-modules/blob/master/teltonika_cmd_exec.rb Exploit, Third Party Advisory
- https://labs.nettitude.com/blog/cve-2017-8116-teltonika-router-unauthenticated-remote-code-execution/ Third Party Advisory