Login Request a demo
High severity · published May 22, 2023
CVE-2023-32350
Versions 00.07.00 through 00.07.03 of Teltonika’s RUT router firmware contain an operating system (OS) command injection vulnerability in a Lua service
8.8
CVSS
1.5%
EPSS
No
On KEV
Description
Versions 00.07.00 through 00.07.03 of Teltonika’s RUT router firmware contain an operating system (OS) command injection vulnerability in a Lua service. An attacker could exploit a parameter in the vulnerable function that calls a user-provided package name by instead providing a package with a malicious name that contains an OS command injection payload.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RF
Rut200 Firmware · Teltonika-networks
00.07.00 through 00.07.03 · source: NVD
RF
Rut240 Firmware · Teltonika-networks
00.07.00 through 00.07.03 · source: NVD
RF
Rut241 Firmware · Teltonika-networks
00.07.00 through 00.07.03 · source: NVD
RF
Rut300 Firmware · Teltonika-networks
00.07.00 through 00.07.03 · source: NVD
RF
Rut360 Firmware · Teltonika-networks
00.07.00 through 00.07.03 · source: NVD
RF
Rut901 Firmware · Teltonika-networks
00.07.00 through 00.07.03 · source: NVD
RF
Rut950 Firmware · Teltonika-networks
00.07.00 through 00.07.03 · source: NVD
RF
Rut951 Firmware · Teltonika-networks
00.07.00 through 00.07.03 · source: NVD
RF
Rut955 Firmware · Teltonika-networks
00.07.00 through 00.07.03 · source: NVD
RF
Rut956 Firmware · Teltonika-networks
00.07.00 through 00.07.03 · source: NVD
RF
Rutx08 Firmware · Teltonika-networks
00.07.00 through 00.07.03 · source: NVD
RF
Rutx09 Firmware · Teltonika-networks
00.07.00 through 00.07.03 · source: NVD
Affected product
RF
Rut200 Firmware
Teltonika-networks
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-32350
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-32350
Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08
More from Rut200 Firmware
8.8
CVE-2023-32349
Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper validation for filter parameters