All vulnerabilities
CVE-2026-75826

RUT: Teltonika Command Injection in Backup function

Teltonika Networks RUT
Open in ThreatlineRecord JSON
CVSS
8.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.94%Chance of exploitation activity in the next 30 days, higher than 60% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in7.24.6Also 7.25.2, 1.10.4CVE List
Published13 Oct 2026Updated 14 Oct 2026CVE List

What fixes it

Show all 16 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 before 1.10.4 (TSW and SWM devices) allows a remote authenticated attacker to execute arbitrary OS commands.

Text from CVE List

Affected versions 16

  • RUTaffected: 7.22 before 7.24.6CVE List
  • RUTXaffected: 7.22 before 7.24.6CVE List
  • RUTXaffected: 7.22 before 7.25.2CVE List
  • RUTMaffected: 7.22 before 7.24.6CVE List
  • RUTMaffected: 7.22 before 7.25.2CVE List
  • RUTCaffected: 7.22 before 7.24.6CVE List
  • ATRMaffected: 7.22 before 7.24.6CVE List
  • TAPaffected: 7.22 before 7.25.2CVE List
  • CAPaffected: 7.22 before 7.24.6CVE List
  • OXAaffected: 7.22 before 7.24.6CVE List
  • DAPaffected: 7.22 before 7.24.6CVE List
  • TRBaffected: 7.22 before 7.24.6CVE List
  • OTDaffected: 7.22 before 7.24.6CVE List
  • EBGaffected: 7.22 before 7.24.6CVE List
  • SWMaffected: 1.9 before 1.10.4CVE List
  • TSWaffected: 1.9 before 1.10.4CVE List

References 1