Dashboard / CVE-2026-82104

CVE-2026-82104

CRITICAL
INFO Priority: 0.04 BB Relevance: 64/100
Published: 2026-10-30 Modified: 2026-10-30 First seen: 2026-10-30 Status: active

Attack Surface

Adjacent Low Complexity No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Adjacent
AC: Low
PR: None
UI: None
AT: None
VC: High
VI: High
VA: High

Description

In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to those requests not following proper flows, this could lead to OS command execution. This issue affects RUT: from 7.22 through 7.24.2; RUTX: from 7.22 through 7.24.2; RUTM: from 7.22 through 7.24.2; RUTC: from 7.22 through 7.24.2; ATRM: from 7.22 through 7.24.2; TAP: from 7.22 through 7.24.2; CAP: from 7.22 through 7.24.2; OXA: from 7.22 through 7.24.2; DAP: from 7.22 through 7.24.2; TRB: from 7.22 through 7.24.2; OTD: from 7.22 through 7.24.2; EBG: from 7.22 through 7.24.2; SWM: from 1.9 through 1.10; TSW: from 1.9 through 1.10.

Affected Software (14)

VendorProductVersion
Teltonika Networks ATRM 7.22
Teltonika Networks CAP 7.22
Teltonika Networks DAP 7.22
Teltonika Networks EBG 7.22
Teltonika Networks OTD 7.22
Teltonika Networks OXA 7.22
Teltonika Networks RUT 7.22
Teltonika Networks RUTC 7.22
Teltonika Networks RUTM 7.22
Teltonika Networks RUTX 7.22
Teltonika Networks SWM 1.9
Teltonika Networks TAP 7.22
Teltonika Networks TRB 7.22
Teltonika Networks TSW 1.9

References & Advisories (1)

Bug Bounty Relevance

64 / 100
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

9.4 / 10.0 v4.0
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

EPSS — Exploitation Probability

0.42%
Raw Score 0.004160
Percentile 35.9%
Date 2026-10-30

Intelligence Sources

mitre ref →
nvd ref →

External Links