CVE-2026-82104
API permission bypass via logic bug
- State
- Published
- Severity
- 9.4 Critical
- Published
- Oct 30, 2026
- Updated
- Oct 30, 2026
- Reserved
- Aug 28, 2026
Description
In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to those requests not following proper flows, this could lead to OS command execution.
This issue affects RUT: from 7.22 through 7.24.2; RUTX: from 7.22 through 7.24.2; RUTM: from 7.22 through 7.24.2; RUTC: from 7.22 through 7.24.2; ATRM: from 7.22 through 7.24.2; TAP: from 7.22 through 7.24.2; CAP: from 7.22 through 7.24.2; OXA: from 7.22 through 7.24.2; DAP: from 7.22 through 7.24.2; TRB: from 7.22 through 7.24.2; OTD: from 7.22 through 7.24.2; EBG: from 7.22 through 7.24.2; SWM: from 1.9 through 1.10; TSW: from 1.9 through 1.10.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.4 Critical | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | tlt_net |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
RUTTeltonika Networks |
|
RUTXTeltonika Networks |
|
RUTMTeltonika Networks |
|
RUTCTeltonika Networks |
|
ATRMTeltonika Networks |
|
TAPTeltonika Networks |
|
CAPTeltonika Networks |
|
OXATeltonika Networks |
|
DAPTeltonika Networks |
|
TRBTeltonika Networks |
|
OTDTeltonika Networks |
|
EBGTeltonika Networks |
|
SWMTeltonika Networks |
|
TSWTeltonika Networks |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.