Filtered by vendor Teltonika-networks Subscriptions
Total 15 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-8256 1 Teltonika-networks 2 Rutos Devices, Tswos 2024-12-10 N/A
In Teltonika Networks RUTOS devices, running on versions 7.0 to 7.8 (excluding) and TSWOS devices running on versions 1.0 to 1.3 (excluding), due to incorrect permission handling a vulnerability exists which allows a lower privileged user with default permissions to access critical device resources via the API.
CVE-2023-32350 1 Teltonika-networks 36 Rut200, Rut200 Firmware, Rut240 and 33 more 2024-11-21 8 High
Versions 00.07.00 through 00.07.03 of Teltonika’s RUT router firmware contain an operating system (OS) command injection vulnerability in a Lua service. An attacker could exploit a parameter in the vulnerable function that calls a user-provided package name by instead providing a package with a malicious name that contains an OS command injection payload.
CVE-2023-32349 1 Teltonika-networks 36 Rut200, Rut200 Firmware, Rut240 and 33 more 2024-11-21 8 High
Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper validation for filter parameters. However, variables for validation checks are stored in an external configuration file. An authenticated attacker could use an exposed UCI configuration utility to change these variables and enable malicious parameters in the dump utility, which could result in arbitrary code execution.
CVE-2023-31728 1 Teltonika-networks 1 Rut240 Firmware 2024-11-21 7 High
Teltonika RUT240 devices with firmware before 07.04.2, when bridge mode is used, sometimes make SSH and HTTP services available on the IPv6 WAN interface even though the UI shows that they are only available on the LAN interface.
CVE-2020-5789 1 Teltonika-networks 2 Trb245, Trb245 Firmware 2024-11-21 6.5 Medium
Relative Path Traversal in Teltonika firmware TRB2_R_00.02.04.3 allows a remote, authenticated attacker to read the contents of arbitrary files on disk.
CVE-2020-5788 1 Teltonika-networks 2 Trb245, Trb245 Firmware 2024-11-21 6.5 Medium
Relative Path Traversal in Teltonika firmware TRB2_R_00.02.04.3 allows a remote, authenticated attacker to delete arbitrary files on disk via the admin/system/admin/certificates/delete action.
CVE-2020-5787 1 Teltonika-networks 2 Trb245, Trb245 Firmware 2024-11-21 6.5 Medium
Relative Path Traversal in Teltonika firmware TRB2_R_00.02.04.3 allows a remote, authenticated attacker to delete arbitrary files on disk via the admin/services/packages/remove action.
CVE-2020-5786 1 Teltonika-networks 2 Trb245, Trb245 Firmware 2024-11-21 8.8 High
Cross-site request forgery in Teltonika firmware TRB2_R_00.02.04.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.
CVE-2020-5785 1 Teltonika-networks 2 Trb245, Trb245 Firmware 2024-11-21 6.1 Medium
Insufficient output sanitization in Teltonika firmware TRB2_R_00.02.04.3 allows an unauthenticated attacker to conduct reflected cross-site scripting via a crafted ‘action’ or ‘pkg_name’ parameter.
CVE-2020-5784 1 Teltonika-networks 2 Trb245, Trb245 Firmware 2024-11-21 6.5 Medium
Server-Side Request Forgery in Teltonika firmware TRB2_R_00.02.04.3 allows a low privileged user to cause the application to perform HTTP GET requests to arbitrary URLs.
CVE-2020-5773 1 Teltonika-networks 2 Trb245, Trb245 Firmware 2024-11-21 8.8 High
Improper Access Control in Teltonika firmware TRB2_R_00.02.04.01 allows a low privileged user to perform unauthorized write operations.
CVE-2020-5772 1 Teltonika-networks 2 Trb245, Trb245 Firmware 2024-11-21 7.5 High
Improper Input Validation in Teltonika firmware TRB2_R_00.02.04.01 allows a remote, authenticated attacker to gain root privileges by uploading a malicious package file.
CVE-2020-5771 1 Teltonika-networks 2 Trb245, Trb245 Firmware 2024-11-21 7.5 High
Improper Input Validation in Teltonika firmware TRB2_R_00.02.04.01 allows a remote, authenticated attacker to gain root privileges by uploading a malicious backup archive.
CVE-2020-5770 1 Teltonika-networks 2 Trb245, Trb245 Firmware 2024-11-21 8.8 High
Cross-site request forgery in Teltonika firmware TRB2_R_00.02.04.01 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.
CVE-2020-5769 1 Teltonika-networks 2 Gateway Trb245, Gateway Trb245 Firmware 2024-11-21 5.4 Medium
Insufficient output sanitization in Teltonika firmware TRB2_R_00.02.02 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks by injecting malicious client-side code into the 'URL/ Host / Connection' form in the 'DATA TO SERVER' configuration section.