CVE-2024-8256

Incorrect Permission Assignment in RutOS based routers and TSWOS based managed switches

State: Published
Severity: 5.9 Medium
Published: Dec 10, 2024
Updated: Dec 10, 2024
Reserved: Aug 28, 2024

Description

In Teltonika Networks RUTOS devices, running on versions 7.0 to 7.8 (excluding) and TSWOS devices running on versions 1.0 to 1.3 (excluding), due to incorrect permission handling a vulnerability exists which allows a lower privileged user with default permissions to access critical device resources via the API.

Scores

CVSS	Score	Vector	Source
4.0	5.9 Medium	CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	tlt_net

Weaknesses

CWE-732 Incorrect Permission Assignment for Critical Resource

Affected Products

Product	Versions
RUTOSTeltonika Networks	7.0 to before 7.8Affected
TSWOSTeltonika Networks	1.0 to before 1.3Affected

References

https://www.deepcove.support/teltonika-responsible-disclosure-proactive-testing-report/third-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.