Teltonika RUTOS/TSWOS: Authentication bypass leading to OS command execution
Summary
Teltonika RUTOS firmware 7.22 through 7.24.2 (RUT, RUTX, RUTM, RUTC, ATRM, TAP, CAP, OXA, DAP, TRB, OTD, EBG) and TswOS 1.9 through 1.10 (SWM, TSW) allow unauthenticated users to call internal LUA functions directly, bypassing validation that normally applies to API requests. Because these requests do not follow the proper flow, an attacker may be able to execute operating system commands on the device. The vendor describes access through the HTTPS port; the CNA vector lists adjacent network access, so the exposure is disputed. Vendor fixes are available.
Affected
- RutOS 7.22 through 7.24.2 on RUT, RUTX, RUTM, RUTC, ATRM, TAP, CAP, OXA, DAP, TRB, OTD and EBG devices
- TswOS 1.9 through 1.10 on SWM and TSW devices
Fixed in
- RutOS 7.24.3 or later
- TswOS 1.10.1 or later
Workaround
- No vendor workaround published.
- Interim measure (own recommendation, not from the vendor): remove internet access to the HTTPS management interface and restrict it to management VLANs or VPN.
Exploitation
- Not known to be exploited in the wild (OffSeq).
- No public exploit available according to VulDB; one aggregator reports no confirmed public exploit code (weak source).
- Not listed in CISA KEV according to one aggregator.
- EPSS: not yet available.
Our recommendation
- Inventory all RUT, RUTX, RUTC, TRB, OTD, TSW and SWM devices and their firmware versions, including remote sites.
- Update to RutOS 7.24.3 or later and TswOS 1.10.1 or later; test first on one device, as a community thread reports problems with 7.24.3 on RUTC and RUTX.
- Remove internet exposure of HTTPS management now and check logs on exposed devices for unexpected web interface requests.
- Monitor NVD, CISA KEV and the Teltonika Security Centre for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Teltonika Security Centre: CVE-2026-82104 www.teltonika-networks.com
- VulDB: CVE-2026-82104 analysis vuldb.com
- OffSeq Radar: CVE-2026-82104 radar.offseq.com
- Strix: CVE-2026-82104 www.strix.ai
- Teltonika firmware updates wiki wiki.teltonika-networks.com
- Teltonika community: 7.24.3 firmware upgrade community.teltonika.lt
- EUVD (ENISA) euvd.enisa.europa.eu
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:37.
Original description (NVD)
In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to those requests not following proper flows, this could lead to OS command execution. This issue affects RUT: from 7.22 through 7.24.2; RUTX: from 7.22 through 7.24.2; RUTM: from 7.22 through 7.24.2; RUTC: from 7.22 through 7.24.2; ATRM: from 7.22 through 7.24.2; TAP: from 7.22 through 7.24.2; CAP: from 7.22 through 7.24.2; OXA: from 7.22 through 7.24.2; DAP: from 7.22 through 7.24.2; TRB: from 7.22 through 7.24.2; OTD: from 7.22 through 7.24.2; EBG: from 7.22 through 7.24.2; SWM: from 1.9 through 1.10; TSW: from 1.9 through 1.10.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.