OS Command Injection Vulnerability in Teltonika RUT Router Firmware

CVE-2023-32350

What is CVE-2023-32350?

Teltonika's RUT router firmware versions 00.07.00 through 00.07.03 are susceptible to an OS command injection vulnerability. This issue arises from a flaw in a Lua service, where an attacker can manipulate input parameters to inject a malicious OS command into the system. By crafting a user-provided package name that contains an OS command payload, an unauthorized user can execute arbitrary commands on the device, potentially leading to unauthorized access and control over the router.

References