CVE-2026-82104: API permission bypass via logic bug
In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to those requests not following proper flows, this could lead to OS command execution.
This issue affects RUT: from 7.22 through 7.24.2; RUTX: from 7.22 through 7.24.2; RUTM: from 7.22 through 7.24.2; RUTC: from 7.22 through 7.24.2; ATRM: from 7.22 through 7.24.2; TAP: from 7.22 through 7.24.2; CAP: from 7.22 through 7.24.2; OXA: from 7.22 through 7.24.2; DAP: from 7.22 through 7.24.2; TRB: from 7.22 through 7.24.2; OTD: from 7.22 through 7.24.2; EBG: from 7.22 through 7.24.2; SWM: from 1.9 through 1.10; TSW: from 1.9 through 1.10.
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated exploitation?
Devices in the affected RUTOS or TSWOS version ranges are exposed if an unauthenticated user can reach the API and directly invoke the vulnerable LUA functions. The issue can lead to OS command execution because those direct requests bypass normal API validation flows.
Does exploitation require valid credentials or user interaction?
No. The vulnerability is described as exploitable by an unauthenticated user, and no user interaction is indicated.
How can I determine whether a device is affected?
Check the device family and installed operating-system version. Affected RUT, RUTX, RUTM, RUTC, ATRM, TAP, CAP, OXA, DAP, TRB, OTD, and EBG devices run RUTOS 7.22 through 7.24.2; affected SWM and TSW devices run TSWOS 1.9 through 1.10.