CVEvulnerability

CVE-2023-32349

8.8 HIGH Published 2023-05-22 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-05-22
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.0 HIGH — CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-15

Description

Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper validation for filter parameters. However, variables for validation checks are stored in an external configuration file. An authenticated attacker could use an exposed UCI configuration utility to change these variables and enable malicious parameters in the dump utility, which could result in arbitrary code execution.

Affected configurations

• teltonika-networks rut200 firmware (<= 00.07.03.4) • teltonika-networks rut240 firmware (<= 00.07.03.4) • teltonika-networks rut241 firmware (<= 00.07.03.4) • teltonika-networks rut300 firmware (<= 00.07.03.4) • teltonika-networks rut360 firmware (<= 00.07.03.4) • teltonika-networks rut901 firmware (<= 00.07.03.4) • teltonika-networks rut950 firmware (<= 00.07.03.4) • teltonika-networks rut951 firmware (<= 00.07.03.4) • teltonika-networks rut955 firmware (<= 00.07.03.4) • teltonika-networks rut956 firmware (<= 00.07.03.4) • teltonika-networks rutx08 firmware (<= 00.07.03.4) • teltonika-networks rutx09 firmware (<= 00.07.03.4) • teltonika-networks rutx10 firmware (<= 00.07.03.4) • teltonika-networks rutx11 firmware (<= 00.07.03.4) • teltonika-networks rutx12 firmware (<= 00.07.03.4) • teltonika-networks rutx14 firmware (>= 00.07.00 <= 00.07.03.4) • teltonika-networks rutx50 firmware (>= 00.07.00 <= 00.07.03.4) • teltonika-networks rutxr1 firmware (>= 00.07.00 <= 00.07.03.4)

Related

Weakness · CWE (1)

  • CWE-15 External Control of System or Configuration Setting weakness

References