{"id":"CVE-2026-82104","title":"API permission bypass via logic bug","summary":"In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validati…","severity":"critical","cvss":9.4,"cvssVector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","cvssSource":"cna","vendor":"Teltonika Networks","product":"RUT","affected":["RUT >= 7.22 <= 7.24.2","RUTX >= 7.22 <= 7.24.2","RUTM >= 7.22 <= 7.24.2","RUTC >= 7.22 <= 7.24.2","ATRM >= 7.22 <= 7.24.2","TAP >= 7.22 <= 7.24.2","CAP >= 7.22 <= 7.24.2","OXA >= 7.22 <= 7.24.2","DAP >= 7.22 <= 7.24.2","TRB >= 7.22 <= 7.24.2","OTD >= 7.22 <= 7.24.2","EBG >= 7.22 <= 7.24.2","SWM >= 1.9 <= 1.10","TSW >= 1.9 <= 1.10"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-30T16:57:34.390915Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T16:57:57.063Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-82104","references":[{"url":"https://www.teltonika-networks.com/support/security-centre?report=CVE-2026-82104"}],"tags":["cve.org"],"epss":0.00389,"epssPercentile":0.33265,"ingestedAt":"2026-11-05T16:24:31.105Z","slug":"CVE-2026-82104","body":"## Overview\n\nIn Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to those requests not following proper flows, this could lead to OS command execution.\n\n\n\nThis issue affects RUT: from 7.22 through 7.24.2; RUTX: from 7.22 through 7.24.2; RUTM: from 7.22 through 7.24.2; RUTC: from 7.22 through 7.24.2; ATRM: from 7.22 through 7.24.2; TAP: from 7.22 through 7.24.2; CAP: from 7.22 through 7.24.2; OXA: from 7.22 through 7.24.2; DAP: from 7.22 through 7.24.2; TRB: from 7.22 through 7.24.2; OTD: from 7.22 through 7.24.2; EBG: from 7.22 through 7.24.2; SWM: from 1.9 through 1.10; TSW: from 1.9 through 1.10.\n\n## Affected\n\n- `RUT >= 7.22 <= 7.24.2`\n- `RUTX >= 7.22 <= 7.24.2`\n- `RUTM >= 7.22 <= 7.24.2`\n- `RUTC >= 7.22 <= 7.24.2`\n- `ATRM >= 7.22 <= 7.24.2`\n- `TAP >= 7.22 <= 7.24.2`\n- `CAP >= 7.22 <= 7.24.2`\n- `OXA >= 7.22 <= 7.24.2`\n- `DAP >= 7.22 <= 7.24.2`\n- `TRB >= 7.22 <= 7.24.2`\n- `OTD >= 7.22 <= 7.24.2`\n- `EBG >= 7.22 <= 7.24.2`\n- `SWM >= 1.9 <= 1.10`\n- `TSW >= 1.9 <= 1.10`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":51.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}