high8.0
CVE-2023-32350
Versions 00.07.00 through 00.07.03 of Teltonika’s RUT router firmware contain an operating system (OS) command injection vulnerability in a Lua service.
Impact
Versions 00.07.00 through 00.07.03 of Teltonika’s RUT router firmware contain an operating system (OS) command injection vulnerability in a Lua service. An attacker could exploit a parameter in the vulnerable function that calls a user-provided package name by instead providing a package with a malicious name that contains an OS command injection payload.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Teltonika-Networks | Rut200 Firmware | from 00.07.00 through 00.07.03 |
| Teltonika-Networks | Rut240 Firmware | from 00.07.00 through 00.07.03 |
| Teltonika-Networks | Rut241 Firmware | from 00.07.00 through 00.07.03 |
| Teltonika-Networks | Rut300 Firmware | from 00.07.00 through 00.07.03 |
| Teltonika-Networks | Rut360 Firmware | from 00.07.00 through 00.07.03 |
| Teltonika-Networks | Rut901 Firmware | from 00.07.00 through 00.07.03 |
| Teltonika-Networks | Rut950 Firmware | from 00.07.00 through 00.07.03 |
| Teltonika-Networks | Rut951 Firmware | from 00.07.00 through 00.07.03 |
| Teltonika-Networks | Rut955 Firmware | from 00.07.00 through 00.07.03 |
| Teltonika-Networks | Rut956 Firmware | from 00.07.00 through 00.07.03 |
| Teltonika-Networks | Rutx08 Firmware | from 00.07.00 through 00.07.03 |
| Teltonika-Networks | Rutx09 Firmware | from 00.07.00 through 00.07.03 |