CVEvulnerability

CVE-2023-32350

8.8 HIGH Published 2023-05-22 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-05-22
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.0 HIGH — CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78

Description

Versions 00.07.00 through 00.07.03 of Teltonika’s RUT router firmware contain an operating system (OS) command injection vulnerability in a Lua service. An attacker could exploit a parameter in the vulnerable function that calls a user-provided package name by instead providing a package with a malicious name that contains an OS command injection payload.

Affected configurations

• teltonika-networks rut200 firmware (>= 00.07.00 <= 00.07.03) • teltonika-networks rut240 firmware (>= 00.07.00 <= 00.07.03) • teltonika-networks rut241 firmware (>= 00.07.00 <= 00.07.03) • teltonika-networks rut300 firmware (>= 00.07.00 <= 00.07.03) • teltonika-networks rut360 firmware (>= 00.07.00 <= 00.07.03) • teltonika-networks rut901 firmware (>= 00.07.00 <= 00.07.03) • teltonika-networks rut950 firmware (>= 00.07.00 <= 00.07.03) • teltonika-networks rut951 firmware (>= 00.07.00 <= 00.07.03) • teltonika-networks rut955 firmware (>= 00.07.00 <= 00.07.03) • teltonika-networks rut956 firmware (>= 00.07.00 <= 00.07.03) • teltonika-networks rutx08 firmware (>= 00.07.00 <= 00.07.03) • teltonika-networks rutx09 firmware (>= 00.07.00 <= 00.07.03) • teltonika-networks rutx10 firmware (>= 00.07.00 <= 00.07.03) • teltonika-networks rutx11 firmware (>= 00.07.00 <= 00.07.03) • teltonika-networks rutx12 firmware (>= 00.07.00 <= 00.07.03) • teltonika-networks rutx14 firmware (>= 00.07.00 <= 00.07.03) • teltonika-networks rutx50 firmware (>= 00.07.00 <= 00.07.03) • teltonika-networks rutxr1 firmware (>= 00.07.00 <= 00.07.03)

Related

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References