---
id: "CVE-2026-82104"
kind: "vulnerability"
aliases: ["CVE-2026-82104"]
title: "Teltonika RUTOS and TSWOS: unauthenticated Lua calls let attackers run OS commands"
severity: "critical"
cvss: 9.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "RUTOS", "fixed": [], "affected": ">= 7.22, <= 7.24.2", "ecosystem": "vendor"}, {"name": "TSWOS", "fixed": [], "affected": ">= 1.9, <= 1.10", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "network-gear", "rce", "routers", "rutos", "teltonika", "tswos", "unauthenticated"]
not_affected_if: ["firmware-outside-range", "isolated-management-network", "management-not-exposed"]
published_at: "2026-10-30T08:17:00+00:00"
first_seen_at: "2026-10-30T08:29:26+00:00"
updated_at: "2026-10-30T08:30:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82104", "first_seen_at": "2026-10-30T08:29:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T08:30:53+00:00"}]
---

# Teltonika RUTOS and TSWOS: unauthenticated Lua calls let attackers run OS commands

Teltonika RUTOS routers (7.22 through 7.24.2) and TSWOS switches (1.9 through 1.10) let an unauthenticated user call Lua functions directly, skipping the checks normal API requests go through. The sources say this can lead to operating system command execution on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:RUTOS affected >= 7.22, <= 7.24.2 fixed ?
- vendor:TSWOS affected >= 1.9, <= 1.10 fixed ?

## How to check

- Read the firmware version in the device WebUI (Status > Overview) or System > Firmware: RUTOS 7.22 to 7.24.2 or TSWOS 1.9 to 1.10 is in range.
- Make sure the WebUI/API is not reachable from untrusted or WAN-side networks; the CVSS vector says the attacker needs adjacent network access.

## Timeline

- 2026-10-30T08:29:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-82104
- 2026-10-30T08:30:53+00:00 analyst — No Teltonika advisory or fixed version found: Security Centre lists nothing for this CVE (checked 2026-10-30), wiki firmware pages do not mention it. Fix unknown; sibling CVE-2026-75826 was fixed in 7.24.6/7.25.2/TSWOS 1.10.4 but that is a different bug, so do not assume. Nothing verified. CVSS 4.0 vector is AV:A (adjacent network), not internet-wide. Settle by reading a RutOS changelog >=7.24.3 or a Teltonika advisory.

## From the sources

In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to those requests not following proper flows, this could lead to OS command execution.



This issue affects RUT: from 7.22 through 7.24.2; RUTX: from 7.22 through 7.24.2; RUTM: from 7.22 through 7.24.2; RUTC: from 7.22 through 7.24.2; ATRM: from 7.22 through 7.24.2; TAP: from 7.22 through 7.24.2; CAP: from 7.22 through 7.24.2; OXA: from 7.22 through 7.24.2; DAP: from 7.22 through 7.24.2; TRB: from 7.22 through 7.24.2; OTD: from 7.22 through 7.24.2; EBG: from 7.22 through 7.24.2; SWM: from 1.9 through 1.10; TSW: from 1.9 through 1.10.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_