Live › vulnerability › CVE-2026-82104
Teltonika RUTOS routers (7.22 through 7.24.2) and TSWOS switches (1.9 through 1.10) let an unauthenticated user call Lua functions directly, skipping the checks normal API requests go through. The sources say this can lead to operating system command execution on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 08:29 UTC. All times on this page are UTC.
Teltonika RUT, RUTX, RUTM, RUTC, ATRM, TAP, CAP, OXA, DAP, TRB, OTD and EBG devices on RUTOS 7.22 to 7.24.2, and TSW and SWM switches on TSWOS 1.9 to 1.10. Devices whose web or API interface can be reached by an attacker without logging in, per CVSS from an adjacent network, are at risk. Devices on other versions, or with management locked to a trusted network, are lower risk.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| RUTOS | vendor | >= 7.22, <= 7.24.2 | – |
| TSWOS | vendor | >= 1.9, <= 1.10 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to those requests not following proper flows, this could lead to OS command execution.
This issue affects RUT: from 7.22 through 7.24.2; RUTX: from 7.22 through 7.24.2; RUTM: from 7.22 through 7.24.2; RUTC: from 7.22 through 7.24.2; ATRM: from 7.22 through 7.24.2; TAP: from 7.22 through 7.24.2; CAP: from 7.22 through 7.24.2; OXA: from 7.22 through 7.24.2; DAP: from 7.22 through 7.24.2; TRB: from 7.22 through 7.24.2; OTD: from 7.22 through 7.24.2; EBG: from 7.22 through 7.24.2; SWM: from 1.9 through 1.10; TSW: from 1.9 through 1.10.
This page as .md · .json · in your agent: get_signal("CVE-2026-82104")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.