Teltonika RUTOS/TSWOS: OS command injection in backup function
Summary
An authenticated attacker with administrative privileges can inject operating system commands through the backup function of Teltonika RUTOS router firmware and TSWOS switch firmware. Successful exploitation grants command execution on the device with high impact on confidentiality, integrity and availability. The CVSS vector uses adjacent network access, so the attacker must be on the same network or have a path to the management interface.
Affected
- RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 for RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD and EBG devices
- RUTOS 7.22 before 7.25.2 for TAP devices
- TSWOS 1.9 before 1.10.4 for TSW and SWM devices
Fixed in
- RUTOS 7.24.6 or later on the 7.24 branch
- RUTOS 7.25.2 or later on the 7.25 branch (TAP: 7.25.2 or later)
- TSWOS 1.10.4 or later
- Versions 7.25.0 and 7.25.1 remain affected.
- Fix versions are derived from the CVE ranges; no vendor advisory confirmed yet.
Workaround
Unknown.
- Restrict web and management interface access to trusted admin networks or VPN.
- Disable remote management where it is not needed.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not listed in CISA KEV.
- No public proof of concept found for this CVE.
- No reports of attacks in the wild.
Our recommendation
- Inventory all Teltonika RUTOS and TSWOS devices and their firmware versions.
- Update to RUTOS 7.24.6 or later (7.24 branch), 7.25.2 or later (7.25 branch, TAP: 7.25.2), or TSWOS 1.10.4 or later.
- Check whether management interfaces are reachable from the internet and restrict access.
- Rotate admin passwords, use unique credentials and MFA where available, and review admin accounts.
- Recheck the Teltonika Security Centre and NVD for an official advisory.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Teltonika Security Centre www.teltonika-networks.com
- GitHub mine-intelligence PR 92 (fixed versions and status) github.com
- VulDB CVE-2026-75826 vuldb.com
- Vulners VulnCheck/VulnRichment CVE-2026-75826 vulners.com
- Strix CVE-2026-75826 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:45.
Original description (NVD)
Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 before 1.10.4 (TSW and SWM devices) allows a remote authenticated attacker to execute arbitrary OS commands.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.