{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-75826", "assignerOrgId": "001d69cf-3fc9-4203-93fb-9865b54e05b2", "state": "PUBLISHED", "assignerShortName": "tlt_net", "dateReserved": "2026-08-18T10:56:03.319Z", "datePublished": "2026-10-13T06:59:06.919Z", "dateUpdated": "2026-10-14T19:00:22.708Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "001d69cf-3fc9-4203-93fb-9865b54e05b2", "shortName": "tlt_net", "dateUpdated": "2026-10-13T07:38:37.887Z" }, "title": "Teltonika Command Injection in Backup function", "problemTypes": [ { "descriptions": [ { "lang": "en", "cweId": "CWE-78", "description": "CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')", "type": "CWE" } ] } ], "impacts": [ { "capecId": "CAPEC-88", "descriptions": [ { "lang": "en", "value": "CAPEC-88 OS Command Injection" } ] } ], "affected": [ { "vendor": "Teltonika Networks", "product": "RUT", "versions": [ { "status": "affected", "version": "7.22", "lessThan": "7.24.6", "versionType": "RUT" } ], "defaultStatus": "unaffected" }, { "vendor": "Teltonika Networks", "product": "RUTX", "versions": [ { "status": "affected", "version": "7.22", "lessThan": "7.24.6", "versionType": "RUTX" }, { "status": "affected", "version": "7.22", "lessThan": "7.25.2", "versionType": "RUTX" } ], "defaultStatus": "unaffected" }, { "vendor": "Teltonika Networks", "product": "RUTM", "versions": [ { "status": "affected", "version": "7.22", "lessThan": "7.24.6", "versionType": "RUTM" }, { "status": "affected", "version": "7.22", "lessThan": "7.25.2", "versionType": "RUTM" } ], "defaultStatus": "unaffected" }, { "vendor": "Teltonika Networks", "product": "RUTC", "versions": [ { "status": "affected", "version": "7.22", "lessThan": "7.24.6", "versionType": "RUTC" } ], "defaultStatus": "unaffected" }, { "vendor": "Teltonika Networks", "product": "ATRM", "versions": [ { "status": "affected", "version": "7.22", "lessThan": "7.24.6", "versionType": "ATRM" } ], "defaultStatus": "unaffected" }, { "vendor": "Teltonika Networks", "product": "TAP", "versions": [ { "status": "affected", "version": "7.22", "lessThan": "7.25.2", "versionType": "TAP" } ], "defaultStatus": "unaffected" }, { "vendor": "Teltonika Networks", "product": "CAP", "versions": [ { "status": "affected", "version": "7.22", "lessThan": "7.24.6", "versionType": "CAP" } ], "defaultStatus": "unaffected" }, { "vendor": "Teltonika Networks", "product": "OXA", "versions": [ { "status": "affected", "version": "7.22", "lessThan": "7.24.6", "versionType": "OXA" } ], "defaultStatus": "unaffected" }, { "vendor": "Teltonika Networks", "product": "DAP", "versions": [ { "status": "affected", "version": "7.22", "lessThan": "7.24.6", "versionType": "DAP" } ], "defaultStatus": "unaffected" }, { "vendor": "Teltonika Networks", "product": "TRB", "versions": [ { "status": "affected", "version": "7.22", "lessThan": "7.24.6", "versionType": "TRB" } ], "defaultStatus": "unaffected" }, { "vendor": "Teltonika Networks", "product": "OTD", "versions": [ { "status": "affected", "version": "7.22", "lessThan": "7.24.6", "versionType": "OTD" } ], "defaultStatus": "unaffected" }, { "vendor": "Teltonika Networks", "product": "EBG", "versions": [ { "status": "affected", "version": "7.22", "lessThan": "7.24.6", "versionType": "EBG" } ], "defaultStatus": "unaffected" }, { "vendor": "Teltonika Networks", "product": "SWM", "versions": [ { "status": "affected", "version": "1.9", "lessThan": "1.10.4", "versionType": "SWM" } ], "defaultStatus": "unaffected" }, { "vendor": "Teltonika Networks", "product": "TSW", "versions": [ { "status": "affected", "version": "1.9", "lessThan": "1.10.4", "versionType": "TSW" } ], "defaultStatus": "unaffected" } ], "descriptions": [ { "lang": "en", "value": "Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 before 1.10.4 (TSW and SWM devices) allows a remote authenticated attacker to execute arbitrary OS commands.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "

Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 before 1.10.4 (TSW and SWM devices) allows a remote authenticated attacker to execute arbitrary OS commands.

" } ] } ], "references": [ { "url": "https://www.teltonika-networks.com/support/security-centre?report=CVE-2026-75826++" } ], "metrics": [ { "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ], "cvssV4_0": { "attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.5, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } } ], "solutions": [ { "lang": "en", "value": "RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, EBG: update to 7.24.6 or later on the 7.24 branch, or 7.25.2 or later on the 7.25 branch\n TAP: update to 7.25.2 or later\nTSW, SWM: update to 1.10.4 or later", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, EBG: update to 7.24.6 or later on the 7.24 branch, or 7.25.2 or later on the 7.25 branch
TAP: update to 7.25.2 or later
TSW, SWM: update to 1.10.4 or later" } ] } ], "source": { "discovery": "EXTERNAL" }, "x_generator": { "engine": "Vulnogram 1.0.4" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-10-14T18:59:58.817850Z", "id": "CVE-2026-75826", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-14T19:00:22.708Z" } } ] } }