CVE-2026-82104: API permission bypass via logic bug

Severity: critical (CVSS 9.4 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-30 · updated 2026-10-30
Weakness: CWE-306

Description

In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to those requests not following proper flows, this could lead to OS command execution. This issue affects RUT: from 7.22 through 7.24.2; RUTX: from 7.22 through 7.24.2; RUTM: from 7.22 through 7.24.2; RUTC: from 7.22 through 7.24.2; ATRM: from 7.22 through 7.24.2; TAP: from 7.22 through 7.24.2; CAP: from 7.22 through 7.24.2; OXA: from 7.22 through 7.24.2; DAP: from 7.22 through 7.24.2; TRB: from 7.22 through 7.24.2; OTD: from 7.22 through 7.24.2; EBG: from 7.22 through 7.24.2; SWM: from 1.9 through 1.10; TSW: from 1.9 through 1.10.

Summary

Teltonika Networks RUTOS (7.22 through 7.24.2) and TSWOS (1.9 through 1.10) devices contain an API permission bypass logic flaw that lets an unauthenticated user call LUA functions directly, skipping normal API validations and potentially achieving OS command execution. The flaw is rated CVSS 9.4 (critical) and affects many product lines, including RUT, RUTX, RUTM, RUTC, ATRM, TAP, CAP, OXA, DAP, TRB, OTD, EBG, SWM and TSW. It is not listed in CISA KEV, so no confirmed in-the-wild exploitation is reported. Update RUTOS and TSWOS devices to a fixed release beyond the affected ranges and restrict API exposure until patched.

تحتوي أجهزة Teltonika Networks العاملة بنظام RUTOS (الإصدارات 7.22 حتى 7.24.2) وTSWOS (الإصدارات 1.9 حتى 1.10) على ثغرة منطقية في تجاوز صلاحيات واجهة API تتيح لمستخدم غير مصادق عليه استدعاء دوال LUA مباشرةً، متجاوزاً عمليات التحقق المعتادة في طلبات API، مما قد يؤدي إلى تنفيذ أوامر على نظام التشغيل. صُنّفت الثغرة بدرجة 9.4 (حرجة) وتؤثر في خطوط منتجات متعددة منها RUT وRUTX وRUTM وRUTC وATRM وTAP وCAP وOXA وDAP وTRB وOTD وEBG وSWM وTSW. لا ترد الثغرة في قائمة CISA KEV، ولا تتوافر معلومات عن استغلال فعلي في البرية. يُنصح بترقية أجهزة RUTOS وTSWOS إلى إصدار مُصلح يتجاوز النطاقات المتأثرة، وتقييد الوصول إلى واجهة API حتى تركيب التحديث.

Affected products

Teltonika Networks ATRM: from 7.22 through 7.24.2
Teltonika Networks CAP: from 7.22 through 7.24.2
Teltonika Networks DAP: from 7.22 through 7.24.2
Teltonika Networks EBG: from 7.22 through 7.24.2
Teltonika Networks OTD: from 7.22 through 7.24.2
Teltonika Networks OXA: from 7.22 through 7.24.2
Teltonika Networks RUT: from 7.22 through 7.24.2
Teltonika Networks RUTC: from 7.22 through 7.24.2
Teltonika Networks RUTM: from 7.22 through 7.24.2
Teltonika Networks RUTX: from 7.22 through 7.24.2
Teltonika Networks SWM: from 1.9 through 1.10
Teltonika Networks TAP: from 7.22 through 7.24.2
Teltonika Networks TRB: from 7.22 through 7.24.2
Teltonika Networks TSW: from 1.9 through 1.10

References

https://www.teltonika-networks.com/support/security-centre?report=CVE-2026-82104

Get alerted when CVE-2026-82104 or the next vulnerability affects your stack