Vulnerability in Teltonika RUT Router Firmware Leading to Potential Code Execution

CVE-2023-32349

What is CVE-2023-32349?

The RUT router firmware from Teltonika, specifically version 00.07.03.4 and earlier, contains a vulnerability related to the packet dump utility that fails to properly validate filter parameters. Although validation checks are present, the variables used for these checks are stored in an external configuration file. This configuration can be altered by an authenticated attacker through an exposed UCI configuration utility, allowing the manipulation of validation variables. By exploiting this vulnerability, an attacker could potentially enable harmful parameters within the dump utility, leading to the execution of arbitrary code.

References