---
id: CVE-2026-82104
title: API permission bypass via logic bug
summary: >-
  In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2
  and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists
  whereby an unauthenticated user can directly call LUA functions, bypassing
  validati…
severity: critical
cvss: 9.4
cvssVector: 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'
cvssSource: cna
vendor: Teltonika Networks
product: RUT
affected:
  - RUT >= 7.22 <= 7.24.2
  - RUTX >= 7.22 <= 7.24.2
  - RUTM >= 7.22 <= 7.24.2
  - RUTC >= 7.22 <= 7.24.2
  - ATRM >= 7.22 <= 7.24.2
  - TAP >= 7.22 <= 7.24.2
  - CAP >= 7.22 <= 7.24.2
  - OXA >= 7.22 <= 7.24.2
  - DAP >= 7.22 <= 7.24.2
  - TRB >= 7.22 <= 7.24.2
  - OTD >= 7.22 <= 7.24.2
  - EBG >= 7.22 <= 7.24.2
  - SWM >= 1.9 <= 1.10
  - TSW >= 1.9 <= 1.10
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-30T16:57:34.390915Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T16:57:57.063Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-82104'
references:
  - url: >-
      https://www.teltonika-networks.com/support/security-centre?report=CVE-2026-82104
tags:
  - cve.org
epss: 0.00389
epssPercentile: 0.33265
ingestedAt: '2026-11-05T16:24:31.105Z'
---

## Overview

In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to those requests not following proper flows, this could lead to OS command execution.



This issue affects RUT: from 7.22 through 7.24.2; RUTX: from 7.22 through 7.24.2; RUTM: from 7.22 through 7.24.2; RUTC: from 7.22 through 7.24.2; ATRM: from 7.22 through 7.24.2; TAP: from 7.22 through 7.24.2; CAP: from 7.22 through 7.24.2; OXA: from 7.22 through 7.24.2; DAP: from 7.22 through 7.24.2; TRB: from 7.22 through 7.24.2; OTD: from 7.22 through 7.24.2; EBG: from 7.22 through 7.24.2; SWM: from 1.9 through 1.10; TSW: from 1.9 through 1.10.

## Affected

- `RUT >= 7.22 <= 7.24.2`
- `RUTX >= 7.22 <= 7.24.2`
- `RUTM >= 7.22 <= 7.24.2`
- `RUTC >= 7.22 <= 7.24.2`
- `ATRM >= 7.22 <= 7.24.2`
- `TAP >= 7.22 <= 7.24.2`
- `CAP >= 7.22 <= 7.24.2`
- `OXA >= 7.22 <= 7.24.2`
- `DAP >= 7.22 <= 7.24.2`
- `TRB >= 7.22 <= 7.24.2`
- `OTD >= 7.22 <= 7.24.2`
- `EBG >= 7.22 <= 7.24.2`
- `SWM >= 1.9 <= 1.10`
- `TSW >= 1.9 <= 1.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.