Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper validation for filter parameters. However, variables for validation checks are stored in an external configuration file. An authenticated attacker could use an exposed UCI configuration utility to change these variables and enable malicious parameters in the dump utility, which could result in arbitrary code execution.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
teltonika-networks rut200_firmware |
||
teltonika-networks rut240_firmware |
||
teltonika-networks rut241_firmware |
||
teltonika-networks rut300_firmware |
||
teltonika-networks rut360_firmware |
||
teltonika-networks rut901_firmware |
||
teltonika-networks rut950_firmware |
||
teltonika-networks rut951_firmware |
||
teltonika-networks rut955_firmware |
||
teltonika-networks rut956_firmware |
||
teltonika-networks rutx08_firmware |
||
teltonika-networks rutx09_firmware |
||
teltonika-networks rutx10_firmware |
||
teltonika-networks rutx11_firmware |
||
teltonika-networks rutx12_firmware |
||
teltonika-networks rutx14_firmware |
||
teltonika-networks rutx50_firmware |
||
teltonika-networks rutxr1_firmware |
Vulmon