CVE-2023-32350: OS Command Injection

Q: What is CVE-2023-32350?

CVE-2023-32350 is a command injection vulnerability in Teltonika’s RUT router firmware.

Q: How does CVE-2023-32350 impact Teltonika's RUT router firmware?

CVE-2023-32350 allows an attacker to execute arbitrary commands on the affected router firmware.

Q: What is the severity of CVE-2023-32350?

The severity of CVE-2023-32350 is high, with a CVSS score of 8.8.

Q: How can I fix CVE-2023-32350 in Teltonika's RUT router firmware?

To fix CVE-2023-32350, it is recommended to update your Teltonika RUT router firmware to a version higher than 00.07.03.

Published May 22, 2023

Updated

Versions 00.07.00 through 00.07.03 of Teltonika’s RUT router firmware contain an operating system (OS) command injection vulnerability in a Lua service. An attacker could exploit a parameter in the vulnerable function that calls a user-provided package name by instead providing a package with a malicious name that contains an OS command injection payload.

Affected Software

40 affected components

Teltonika Remote Management System (RMS): Versions prior to 4.10.0 (affected by CVE-2023-32346, CVE-2023-32347, CVE-2023-32348, CVE-2023-2587, CVE-2023-2588)

Teltonika Remote Management System (RMS): Versions prior to 4.14.0 (affected by CVE-2023-2586)

Teltonika RUT model routers: Version 00.07.00 through 00.07.03.4 (affected by CVE-2023-32349)

Teltonika RUT model routers: Version 00.07.00 through 00.07.03 (affected by CVE-2023-32350)

Teltonika-networks Rut200 Firmware>=00.07.00<=00.07.03

Teltonika-networks Rut200

Teltonika-networks Rut240 Firmware>=00.07.00<=00.07.03

Teltonika-networks Rut240

Teltonika-networks Rut241 Firmware>=00.07.00<=00.07.03

Teltonika-networks Rut241

Teltonika-networks Rut300 Firmware>=00.07.00<=00.07.03

Teltonika-networks Rut300

Teltonika-networks Rut360 Firmware>=00.07.00<=00.07.03

Teltonika-networks Rut360

Teltonika-networks Rut901 Firmware>=00.07.00<=00.07.03

Teltonika-networks Rut901

Teltonika-networks Rut950 Firmware>=00.07.00<=00.07.03

Teltonika-networks Rut950

Teltonika-networks Rut951 Firmware>=00.07.00<=00.07.03

Teltonika-networks Rut951

Teltonika-networks Rut955 Firmware>=00.07.00<=00.07.03

Teltonika-networks Rut955

Teltonika-networks Rut956 Firmware>=00.07.00<=00.07.03

Teltonika-networks Rut956

Teltonika-networks Rutx08 Firmware>=00.07.00<=00.07.03

Teltonika-networks Rutx08

Teltonika-networks Rutx09 Firmware>=00.07.00<=00.07.03

Teltonika-networks Rutx09

Teltonika-networks Rutx10 Firmware>=00.07.00<=00.07.03

Teltonika-networks Rutx10

Teltonika-networks Rutx11 Firmware>=00.07.00<=00.07.03

Teltonika-networks Rutx11

Teltonika-networks Rutx12 Firmware>=00.07.00<=00.07.03

Teltonika-networks Rutx12

Teltonika-networks Rutx14 Firmware>=00.07.00<=00.07.03

Teltonika-networks Rutx14

Teltonika-networks Rutx50 Firmware>=00.07.00<=00.07.03

Teltonika-networks Rutx50

Teltonika-networks Rutxr1 Firmware>=00.07.00<=00.07.03

Teltonika-networks Rutxr1

Event History

May 22, 2023

CVE Published

via MITRE·03:14 PM

Data Sourced

via MITRE·03:14 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

ICSA-23-131-08

Frequently Asked Questions

What is CVE-2023-32350?

CVE-2023-32350 is a command injection vulnerability in Teltonika’s RUT router firmware.

How does CVE-2023-32350 impact Teltonika's RUT router firmware?

CVE-2023-32350 allows an attacker to execute arbitrary commands on the affected router firmware.

Which versions of Teltonika's RUT router firmware are affected by CVE-2023-32350?

Versions 00.07.00 through 00.07.03 of Teltonika’s RUT router firmware are affected by CVE-2023-32350.

What is the severity of CVE-2023-32350?