What’s Vulnerable › Vulnerabilities
CVE-2026-8914: Command injection in Profile change function
- Severity: high (CVSS 8.4 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-05 · updated 2026-06-17
- Weakness: CWE-95
Description
In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1, due to unsafe calls to an eval function in rpc-profile, a vulnerability exists where a lower privileged user could perform command injection as the root user.
Affected products
- Teltonika Networks RUTOS: from 7.22 through 7.23.2
- Teltonika Networks TSWOS: from 1.09 through 1.09.1
References
Get alerted when CVE-2026-8914 or the next vulnerability affects your stack