CVE-2023-32349
High
Description
Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper validation for filter parameters. However, variables for validation checks are stored in an external configuration file. An authenticated attacker could use an exposed UCI configuration utility to change these variables and enable malicious parameters in the dump utility, which could result in arbitrary code execution.
SeverityHigh
CVSS8.0
Exploit probability—
ProductTeltonika-networks Rut200 Firmware
PublishedMay 22, 2023
First seenMay 22, 2023
Weakness typeCWE-15CWE-15
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| teltonika-networks rut200_firmware | v ≤ 00.07.03.4 | — |
| teltonika-networks rut240_firmware | v ≤ 00.07.03.4 | — |
| teltonika-networks rut241_firmware | v ≤ 00.07.03.4 | — |
| teltonika-networks rut300_firmware | v ≤ 00.07.03.4 | — |
| teltonika-networks rut360_firmware | v ≤ 00.07.03.4 | — |
| teltonika-networks rut901_firmware | v ≤ 00.07.03.4 | — |
| teltonika-networks rut950_firmware | v ≤ 00.07.03.4 | — |
| teltonika-networks rut951_firmware | v ≤ 00.07.03.4 | — |
| teltonika-networks rut955_firmware | v ≤ 00.07.03.4 | — |
| teltonika-networks rut956_firmware | v ≤ 00.07.03.4 | — |
| teltonika-networks rutx08_firmware | v ≤ 00.07.03.4 | — |
| teltonika-networks rutx09_firmware | v ≤ 00.07.03.4 | — |
| teltonika-networks rutx10_firmware | v ≤ 00.07.03.4 | — |
| teltonika-networks rutx11_firmware | v ≤ 00.07.03.4 | — |
| teltonika-networks rutx12_firmware | v ≤ 00.07.03.4 | — |
| teltonika-networks rutx14_firmware | 00.07.00 ≤ v ≤ 00.07.03.4 | — |
| teltonika-networks rutx50_firmware | 00.07.00 ≤ v ≤ 00.07.03.4 | — |
| teltonika-networks rutxr1_firmware | 00.07.00 ≤ v ≤ 00.07.03.4 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.