CVE-2023-32350

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-05-22 · updated 2026-06-17
Weakness: CWE-78

Description

Versions 00.07.00 through 00.07.03 of Teltonika’s RUT router firmware contain an operating system (OS) command injection vulnerability in a Lua service. An attacker could exploit a parameter in the vulnerable function that calls a user-provided package name by instead providing a package with a malicious name that contains an OS command injection payload.

Affected products

Teltonika-Networks Rut200 Firmware: from 00.07.00 through 00.07.03
Teltonika-Networks Rut240 Firmware: from 00.07.00 through 00.07.03
Teltonika-Networks Rut241 Firmware: from 00.07.00 through 00.07.03
Teltonika-Networks Rut300 Firmware: from 00.07.00 through 00.07.03
Teltonika-Networks Rut360 Firmware: from 00.07.00 through 00.07.03
Teltonika-Networks Rut901 Firmware: from 00.07.00 through 00.07.03
Teltonika-Networks Rut950 Firmware: from 00.07.00 through 00.07.03
Teltonika-Networks Rut951 Firmware: from 00.07.00 through 00.07.03
Teltonika-Networks Rut955 Firmware: from 00.07.00 through 00.07.03
Teltonika-Networks Rut956 Firmware: from 00.07.00 through 00.07.03
Teltonika-Networks Rutx08 Firmware: from 00.07.00 through 00.07.03
Teltonika-Networks Rutx09 Firmware: from 00.07.00 through 00.07.03
Teltonika-Networks Rutx10 Firmware: from 00.07.00 through 00.07.03
Teltonika-Networks Rutx11 Firmware: from 00.07.00 through 00.07.03
Teltonika-Networks Rutx12 Firmware: from 00.07.00 through 00.07.03
Teltonika-Networks Rutx14 Firmware: from 00.07.00 through 00.07.03
Teltonika-Networks Rutx50 Firmware: from 00.07.00 through 00.07.03
Teltonika-Networks Rutxr1 Firmware: from 00.07.00 through 00.07.03

References

Get alerted when CVE-2023-32350 or the next vulnerability affects your stack