{"id":"CVE-2026-82104","kind":"vulnerability","aliases":["CVE-2026-82104"],"related":[],"title":"Teltonika RUTOS and TSWOS: unauthenticated Lua calls let attackers run OS commands","description":"In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to those requests not following proper flows, this could lead to OS command execution.\n\n\n\nThis issue affects RUT: from 7.22 through 7.24.2; RUTX: from 7.22 through 7.24.2; RUTM: from 7.22 through 7.24.2; RUTC: from 7.22 through 7.24.2; ATRM: from 7.22 through 7.24.2; TAP: from 7.22 through 7.24.2; CAP: from 7.22 through 7.24.2; OXA: from 7.22 through 7.24.2; DAP: from 7.22 through 7.24.2; TRB: from 7.22 through 7.24.2; OTD: from 7.22 through 7.24.2; EBG: from 7.22 through 7.24.2; SWM: from 1.9 through 1.10; TSW: from 1.9 through 1.10.","summary":"Teltonika RUTOS routers (7.22 through 7.24.2) and TSWOS switches (1.9 through 1.10) let an unauthenticated user call Lua functions directly, skipping the checks normal API requests go through. The sources say this can lead to operating system command execution on the device.","severity":"critical","cvss":9.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"RUTOS","fixed":[],"affected":">= 7.22, <= 7.24.2","ecosystem":"vendor"},{"name":"TSWOS","fixed":[],"affected":">= 1.9, <= 1.10","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","network-gear","rce","routers","rutos","teltonika","tswos","unauthenticated"],"not_affected_if":["firmware-outside-range","isolated-management-network","management-not-exposed"],"how_to_check":"- Read the firmware version in the device WebUI (Status > Overview) or System > Firmware: RUTOS 7.22 to 7.24.2 or TSWOS 1.9 to 1.10 is in range.\n- Make sure the WebUI/API is not reachable from untrusted or WAN-side networks; the CVSS vector says the attacker needs adjacent network access.","fix":null,"status":"open","published_at":"2026-10-30T08:17:00+00:00","first_seen_at":"2026-10-30T08:29:26+00:00","triaged_at":"2026-10-30T08:30:16+00:00","updated_at":"2026-10-30T08:30:53+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-30T08:30:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Teltonika RUTOS and TSWOS: unauthenticated Lua calls let attackers run OS commands","impact":"high","summary":"Teltonika RUTOS routers (7.22 through 7.24.2) and TSWOS switches (1.9 through 1.10) let an unauthenticated user call Lua functions directly, skipping the checks normal API requests go through. The sources say this can lead to operating system command execution on the device.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["teltonika","rutos","tswos","routers","network-gear"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs operating system commands on the device without logging in","analyst_note":"Confirm the reachable interface (web, API or other) and whether a vendor advisory or patched firmware version exists; the NVD entry alone does not state a fix.","how_to_check":"- Check the firmware version on each Teltonika device (RUTOS or TSWOS) against the affected ranges.\n- Confirm the device's management interface is not reachable from the internet.\n- unknown for any further checks; the sources do not describe specific log entries or files.","plain_action":"","needs_analyst":true,"not_affected_if":["firmware-outside-range","management-not-exposed"],"who_is_affected":"Teltonika RUT, RUTX, RUTM, RUTC, ATRM, TAP, CAP, OXA, DAP, TRB, OTD, EBG routers on RUTOS 7.22 through 7.24.2, and SWM or TSW switches on TSWOS 1.9 through 1.10, are affected. Devices whose web or API interface is reachable by an attacker are the main concern. The sources do not say whether a non-default configuration is required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000776,"input_tokens":4420,"output_tokens":668,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the reachable interface (web, API or other) and whether a vendor advisory or patched firmware version exists; the NVD entry alone does not state a fix.","search":"'-2026':14A,17A '-82104':15A,18A '1.10':42B,91C,196C,201C '1.9':40B,89C,194C,199C '7.22':34B,81C,134C,139C,144C,149C,154C,159C,164C,169C,174C,179C,184C,189C '7.24.2':36B,83C,136C,141C,146C,151C,156C,161C,166C,171C,176C,181C,186C,191C 'affect':131C 'api':55B,112C 'atrm':152C 'attack':9A 'bypass':104C 'call':7A,47B,101C,109C 'cap':162C 'check':53B 'command':12A,68B,127C 'could':123C 'cve':13A,16A 'dap':172C 'devic':72B,77C,86C 'direct':50B,100C 'due':114C 'ebg':187C 'execut':69B,128C 'exist':94C 'flow':121C 'follow':119C 'function':49B,103C 'gear':24B 'go':57B 'infrastructur':21B 'issu':130C 'lead':64B,124C 'let':8A,43B 'lua':6A,48B,102C 'might':107C 'network':23B,75C 'network-gear':22B 'normal':54B,111C 'oper':66B 'os':11A,126C 'otd':182C 'oxa':167C 'proper':120C 'rce':25B 'request':56B,113C,117C 'router':26B,33B 'run':10A,78C,87C 'rut':132C 'rutc':147C 'rutm':142C 'ruto':2A,27B,32B,76C 'rutos':19A 'rutx':137C 'say':61B 'skip':51B 'sourc':60B 'switch':39B 'swm':192C 'system':67B 'tap':157C 'teltonika':1A,28B,31B,74C 'trb':177C 'tsw':197C 'tswos':4A,20A,29B,38B,85C 'unauthent':5A,30B,45B,97C 'user':46B,98C 'valid':105C 'version':79C,88C 'vulner':93C 'wherebi':95C","nicknames":[],"mitigations":[],"who_affected":"Teltonika RUT, RUTX, RUTM, RUTC, ATRM, TAP, CAP, OXA, DAP, TRB, OTD and EBG devices on RUTOS 7.22 to 7.24.2, and TSW and SWM switches on TSWOS 1.9 to 1.10. Devices whose web or API interface can be reached by an attacker without logging in, per CVSS from an adjacent network, are at risk. Devices on other versions, or with management locked to a trusted network, are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T08:17:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"001d69cf-3fc9-4203-93fb-9865b54e05b2","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82104","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82104","severity":null,"published_at":"2026-10-30T08:17:00+00:00","modified_at":"2026-10-30T08:17:00+00:00","first_seen_at":"2026-10-30T08:29:26+00:00","fetched_at":"2026-10-30T08:29:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-82104:1137","url":null,"severity":null,"published_at":"2026-10-30T08:30:53+00:00","modified_at":"2026-10-30T08:30:53+00:00","first_seen_at":"2026-10-30T08:30:53+00:00","fetched_at":"2026-10-30T08:30:53+00:00","note":"No Teltonika advisory or fixed version found: Security Centre lists nothing for this CVE (checked 2026-10-30), wiki firmware pages do not mention it. Fix unknown; sibling CVE-2026-75826 was fixed in 7.24.6/7.25.2/TSWOS 1.10.4 but that is a different bug, so do not assume. Nothing verified. CVSS 4.0 vector is AV:A (adjacent network), not internet-wide. Settle by reading a RutOS changelog >=7.24.3 or a Teltonika advisory."}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}