CVE-2026-75826
HighCVSS 8.5Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 before 1.10.4 (TSW and SWM devices) allows a remote authenticated attacker to execute arbitrary OS commands.
Risk Assessment
An authenticated attacker with network access can execute arbitrary OS commands on the device, potentially leading to full control of the router or switch and network traffic.
Recommendation
Update RUTOS to version 7.24.6 or 7.25.2 (or later) and TSWOS to version 1.10.4 (or later); until then, restrict access to the management interface.
Other vulnerabilities in Teltonika Networks RUTOS/TSWOS
See all- CVE-2026-82104Critical
In Teltonika Networks RUTOS devices (versions 7.22 through 7.24.2) and TSWOS devices (versions 1.9 through 1.10), an unauthenticated user can directly call LUA functions, bypassing validations that would normally apply to API requests. Because these requests do not follow proper flows, this can lead to OS command execution.
- CVE-2026-16455Medium
In Teltonika Networks RUTOS devices running versions 7.07.1 through 7.24.1 and TSWOS devices running versions 1.03 through 1.10, a vulnerability exists whereby a lower privileged user can escalate privileges to administrative level due to unsafe calls to an execl function.
Original NVD description (English source)
Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 before 1.10.4 (TSW and SWM devices) allows a remote authenticated attacker to execute arbitrary OS commands.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS