CVE-2026-8914: Command injection in Profile change function

Description

In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1, due to unsafe calls to an eval function in rpc-profile, a vulnerability exists where a lower privileged user could perform command injection as the root user.

Exploitation

Is it being used?

Exploit prediction (EPSS)0.5% · higher than 45% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

RU

RUTOS · Teltonika Networks

7.22 through 7.23.2 · source: vendor

TS

TSWOS · Teltonika Networks

1.09 through 1.09.1 · source: vendor