Command Injection Vulnerability in Teltonika Networks RUTOS and TSWOS Devices
CVE-2026-8914

8.4HIGH

Key Information:

Vendor

Teltonika Networks

Status
Rutos
Tswos
Vendor
CVE Published:
5 June 2026

What is CVE-2026-8914?

A command injection vulnerability exists in Teltonika Networks RUTOS and TSWOS devices, specifically in versions 7.22 through 7.23.2 and 1.09 through 1.09.1. This flaw arises from unsafe calls to an eval function within the rpc-profile, allowing a lower privileged user to execute commands with the root user’s permissions. This can lead to unauthorized access and control over the affected devices.

Affected Version(s)

RUTOS 7.22 <= 7.23.2

TSWOS 1.09 <= 1.09.1

References

https://www.teltonika-networks.com/support/security-centre

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.