Medium severity · published Dec 10, 2024
CVE-2024-8256
Incorrect Permission Assignment in RutOS based routers and TSWOS based managed switches
5.9
CVSS
0.2%
EPSS
No
On KEV
Description
In Teltonika Networks RUTOS devices, running on versions 7.0 to 7.8 (excluding) and TSWOS devices running on versions 1.0 to 1.3 (excluding), due to incorrect permission handling a vulnerability exists which allows a lower privileged user with default permissions to access critical device resources via the API.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RU
RUTOS · Teltonika Networks
7.0 before 7.8 · source: vendor
TS
TSWOS · Teltonika Networks
1.0 before 1.3 · source: vendor, CISA
RD
Rutos Devices · Teltonika-networks
7.0 before 7.8 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-8256
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-8256
www.deepcove.support
https://www.deepcove.support/teltonika-responsible-disclosure-proactive-testing-report/
More from RUTOS
8.4
CVE-2026-8914
Command injection in Profile change function
6.9
CVE-2026-16455
Local privilege escalation via improper input sanitization in execl() call
6.0
CVE-2026-18368
Heap buffer overflow in Modbusgwd