CVE-2026-8914 (GCVE-0-2026-8914)

Vulnerability from cvelistv5 – Published: 2026-06-05 09:36 – Updated: 2026-06-05 20:21
VLAI
Title
Command injection in Profile change function
Summary
In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1, due to unsafe calls to an eval function in rpc-profile, a vulnerability exists where a lower privileged user could perform command injection as the root user.
Severity
8.4 (High)
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-95 - Improper neutralization of directives in dynamically evaluated code ('eval injection')
Assigner
References
Impacted products
Vendor Product Version
Teltonika Networks RUTOS Affected: 7.22 , ≤ 7.23.2 (custom)
Create a notification for this product.
Teltonika Networks TSWOS Affected: 1.09 , ≤ 1.09.1 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-8914",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-05T20:21:49.190196Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-05T20:21:59.678Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "RUTOS",
          "vendor": "Teltonika Networks",
          "versions": [
            {
              "lessThanOrEqual": "7.23.2",
              "status": "affected",
              "version": "7.22",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TSWOS",
          "vendor": "Teltonika Networks",
          "versions": [
            {
              "lessThanOrEqual": "1.09.1",
              "status": "affected",
              "version": "1.09",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan\u003eIn Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1, due to unsafe calls to an \u003ccode\u003eeval\u003c/code\u003e function\u003cstrong\u003e in rpc-profile,\u003c/strong\u003e a vulnerability exists where a lower privileged user could perform command injection as the \u003ccode\u003eroot\u003c/code\u003e user.\u003c/span\u003e"
            }
          ],
          "value": "In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1, due to unsafe calls to an eval function in rpc-profile, a vulnerability exists where a lower privileged user could perform command injection as the root user."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-35",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-35 Leverage Executable Code in Non-Executable Files"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-95",
              "description": "CWE-95 Improper neutralization of directives in dynamically evaluated code (\u0027eval injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-05T09:40:12.559Z",
        "orgId": "001d69cf-3fc9-4203-93fb-9865b54e05b2",
        "shortName": "tlt_net"
      },
      "references": [
        {
          "url": "https://www.teltonika-networks.com/support/security-centre"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to RUTOS 7.23.3 or later."
            }
          ],
          "value": "Update to RUTOS 7.23.3 or later."
        },
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to TSWOS 1.10 or later."
            }
          ],
          "value": "Update to TSWOS 1.10 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Command injection in Profile change function",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "001d69cf-3fc9-4203-93fb-9865b54e05b2",
    "assignerShortName": "tlt_net",
    "cveId": "CVE-2026-8914",
    "datePublished": "2026-06-05T09:36:29.744Z",
    "dateReserved": "2026-05-19T05:45:27.190Z",
    "dateUpdated": "2026-06-05T20:21:59.678Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-8914",
      "date": "2026-06-12",
      "epss": "0.00156",
      "percentile": "0.36268"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-8914\",\"sourceIdentifier\":\"001d69cf-3fc9-4203-93fb-9865b54e05b2\",\"published\":\"2026-06-05T11:16:37.043\",\"lastModified\":\"2026-06-05T14:59:51.620\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1, due to unsafe calls to an eval function in rpc-profile, a vulnerability exists where a lower privileged user could perform command injection as the root user.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"001d69cf-3fc9-4203-93fb-9865b54e05b2\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}]},\"weaknesses\":[{\"source\":\"001d69cf-3fc9-4203-93fb-9865b54e05b2\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-95\"}]}],\"references\":[{\"url\":\"https://www.teltonika-networks.com/support/security-centre\",\"source\":\"001d69cf-3fc9-4203-93fb-9865b54e05b2\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"001d69cf-3fc9-4203-93fb-9865b54e05b2\", \"shortName\": \"tlt_net\", \"dateUpdated\": \"2026-06-05T09:40:12.559Z\"}, \"title\": \"Command injection in Profile change function\", \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"cweId\": \"CWE-95\", \"description\": \"CWE-95 Improper neutralization of directives in dynamically evaluated code (\u0027eval injection\u0027)\", \"type\": \"CWE\"}]}], \"impacts\": [{\"capecId\": \"CAPEC-35\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-35 Leverage Executable Code in Non-Executable Files\"}]}], \"affected\": [{\"vendor\": \"Teltonika Networks\", \"product\": \"RUTOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.22\", \"lessThanOrEqual\": \"7.23.2\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Teltonika Networks\", \"product\": \"TSWOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.09\", \"lessThanOrEqual\": \"1.09.1\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1, due to unsafe calls to an eval function in rpc-profile, a vulnerability exists where a lower privileged user could perform command injection as the root user.\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"\u003cspan\u003eIn Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1, due to unsafe calls to an \u003ccode\u003eeval\u003c/code\u003e function\u003cstrong\u003e in rpc-profile,\u003c/strong\u003e a vulnerability exists where a lower privileged user could perform command injection as the \u003ccode\u003eroot\u003c/code\u003e user.\u003c/span\u003e\"}]}], \"references\": [{\"url\": \"https://www.teltonika-networks.com/support/security-centre\"}], \"metrics\": [{\"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}], \"cvssV4_0\": {\"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subIntegrityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"exploitMaturity\": \"NOT_DEFINED\", \"Safety\": \"NOT_DEFINED\", \"Automatable\": \"NOT_DEFINED\", \"Recovery\": \"NOT_DEFINED\", \"valueDensity\": \"NOT_DEFINED\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"version\": \"4.0\", \"baseSeverity\": \"HIGH\", \"baseScore\": 8.4, \"vectorString\": \"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\"}}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Update to RUTOS 7.23.3 or later.\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"Update to RUTOS 7.23.3 or later.\"}]}, {\"lang\": \"en\", \"value\": \"Update to TSWOS 1.10 or later.\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"Update to TSWOS 1.10 or later.\"}]}], \"source\": {\"discovery\": \"UNKNOWN\"}, \"x_generator\": {\"engine\": \"Vulnogram 1.0.2\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-8914\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-05T20:21:49.190196Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-05T20:21:54.730Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-8914\", \"assignerOrgId\": \"001d69cf-3fc9-4203-93fb-9865b54e05b2\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"tlt_net\", \"dateReserved\": \"2026-05-19T05:45:27.190Z\", \"datePublished\": \"2026-06-05T09:36:29.744Z\", \"dateUpdated\": \"2026-06-05T20:21:59.678Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.