CVE-2026-82104 PUBLISHED

API permission bypass via logic bug

Assigner: tlt_net
Reserved: 28.08.2026 Published: 30.10.2026 Updated: 30.10.2026

In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to those requests not following proper flows, this could lead to OS command execution.

This issue affects RUT: from 7.22 through 7.24.2; RUTX: from 7.22 through 7.24.2; RUTM: from 7.22 through 7.24.2; RUTC: from 7.22 through 7.24.2; ATRM: from 7.22 through 7.24.2; TAP: from 7.22 through 7.24.2; CAP: from 7.22 through 7.24.2; OXA: from 7.22 through 7.24.2; DAP: from 7.22 through 7.24.2; TRB: from 7.22 through 7.24.2; OTD: from 7.22 through 7.24.2; EBG: from 7.22 through 7.24.2; SWM: from 1.9 through 1.10; TSW: from 1.9 through 1.10.

Metrics

CVSS Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score: 9.4

Product Status

Vendor Teltonika Networks
Product RUT
Versions Default: unaffected
  • affected from 7.22 to 7.24.2 (incl.)
Vendor Teltonika Networks
Product RUTX
Versions Default: unaffected
  • affected from 7.22 to 7.24.2 (incl.)
Vendor Teltonika Networks
Product RUTM
Versions Default: unaffected
  • affected from 7.22 to 7.24.2 (incl.)
Vendor Teltonika Networks
Product RUTC
Versions Default: unaffected
  • affected from 7.22 to 7.24.2 (incl.)
Vendor Teltonika Networks
Product ATRM
Versions Default: unaffected
  • affected from 7.22 to 7.24.2 (incl.)
Vendor Teltonika Networks
Product TAP
Versions Default: unaffected
  • affected from 7.22 to 7.24.2 (incl.)
Vendor Teltonika Networks
Product CAP
Versions Default: unaffected
  • affected from 7.22 to 7.24.2 (incl.)
Vendor Teltonika Networks
Product OXA
Versions Default: unaffected
  • affected from 7.22 to 7.24.2 (incl.)
Vendor Teltonika Networks
Product DAP
Versions Default: unaffected
  • affected from 7.22 to 7.24.2 (incl.)
Vendor Teltonika Networks
Product TRB
Versions Default: unaffected
  • affected from 7.22 to 7.24.2 (incl.)
Vendor Teltonika Networks
Product OTD
Versions Default: unaffected
  • affected from 7.22 to 7.24.2 (incl.)
Vendor Teltonika Networks
Product EBG
Versions Default: unaffected
  • affected from 7.22 to 7.24.2 (incl.)
Vendor Teltonika Networks
Product SWM
Versions Default: unaffected
  • affected from 1.9 to 1.10 (incl.)
Vendor Teltonika Networks
Product TSW
Versions Default: unaffected
  • affected from 1.9 to 1.10 (incl.)

References

Problem Types

  • CWE‑863: Incorrect Authorization

Impacts

  • CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs