CVE-2026-82104 API permission bypass via logic bug
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to those requests not following proper flows, this could lead to OS command execution.
This issue affects RUT: from 7.22 through 7.24.2; RUTX: from 7.22 through 7.24.2; RUTM: from 7.22 through 7.24.2; RUTC: from 7.22 through 7.24.2; ATRM: from 7.22 through 7.24.2; TAP: from 7.22 through 7.24.2; CAP: from 7.22 through 7.24.2; OXA: from 7.22 through 7.24.2; DAP: from 7.22 through 7.24.2; TRB: from 7.22 through 7.24.2; OTD: from 7.22 through 7.24.2; EBG: from 7.22 through 7.24.2; SWM: from 1.9 through 1.10; TSW: from 1.9 through 1.10.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Teltonika Networks RUT | >= 7.22, <= 7.24.2 | No fix listed |
| Teltonika Networks RUTX | >= 7.22, <= 7.24.2 | No fix listed |
| Teltonika Networks RUTM | >= 7.22, <= 7.24.2 | No fix listed |
| Teltonika Networks RUTC | >= 7.22, <= 7.24.2 | No fix listed |
| Teltonika Networks ATRM | >= 7.22, <= 7.24.2 | No fix listed |
| Teltonika Networks TAP | >= 7.22, <= 7.24.2 | No fix listed |
| Teltonika Networks CAP | >= 7.22, <= 7.24.2 | No fix listed |
| Teltonika Networks OXA | >= 7.22, <= 7.24.2 | No fix listed |
| Teltonika Networks DAP | >= 7.22, <= 7.24.2 | No fix listed |
| Teltonika Networks TRB | >= 7.22, <= 7.24.2 | No fix listed |
| Teltonika Networks OTD | >= 7.22, <= 7.24.2 | No fix listed |
| Teltonika Networks EBG | >= 7.22, <= 7.24.2 | No fix listed |
| Teltonika Networks SWM | >= 1.9, <= 1.10 | No fix listed |
| Teltonika Networks TSW | >= 1.9, <= 1.10 | No fix listed |