CVE-2026-75826

Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 before 1.10.4 (TSW and SWM devices) allows a remote authenticated attacker to execute arbitrary OS commands.

CVSS

No CVSS.

References

Link	Resource
https://www.teltonika-networks.com/support/security-centre?report=CVE-2026-75826++

Configurations

No configuration.

History

13 Oct 2026, 07:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-13 07:16

Updated : 2026-10-16 19:56

NVD link : CVE-2026-75826

Mitre link : CVE-2026-75826

CVE.ORG link : CVE-2026-75826

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-75826", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75826", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-14T18:59:58.817850Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "001d69cf-3fc9-4203-93fb-9865b54e05b2", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "001d69cf-3fc9-4203-93fb-9865b54e05b2", "affectedData": [{"vendor": "Teltonika Networks", "product": "RUT", "versions": [{"status": "affected", "version": "7.22", "lessThan": "7.24.6", "versionType": "RUT"}], "defaultStatus": "unaffected"}, {"vendor": "Teltonika Networks", "product": "RUTX", "versions": [{"status": "affected", "version": "7.22", "lessThan": "7.24.6", "versionType": "RUTX"}, {"status": "affected", "version": "7.22", "lessThan": "7.25.2", "versionType": "RUTX"}], "defaultStatus": "unaffected"}, {"vendor": "Teltonika Networks", "product": "RUTM", "versions": [{"status": "affected", "version": "7.22", "lessThan": "7.24.6", "versionType": "RUTM"}, {"status": "affected", "version": "7.22", "lessThan": "7.25.2", "versionType": "RUTM"}], "defaultStatus": "unaffected"}, {"vendor": "Teltonika Networks", "product": "RUTC", "versions": [{"status": "affected", "version": "7.22", "lessThan": "7.24.6", "versionType": "RUTC"}], "defaultStatus": "unaffected"}, {"vendor": "Teltonika Networks", "product": "ATRM", "versions": [{"status": "affected", "version": "7.22", "lessThan": "7.24.6", "versionType": "ATRM"}], "defaultStatus": "unaffected"}, {"vendor": "Teltonika Networks", "product": "TAP", "versions": [{"status": "affected", "version": "7.22", "lessThan": "7.25.2", "versionType": "TAP"}], "defaultStatus": "unaffected"}, {"vendor": "Teltonika Networks", "product": "CAP", "versions": [{"status": "affected", "version": "7.22", "lessThan": "7.24.6", "versionType": "CAP"}], "defaultStatus": "unaffected"}, {"vendor": "Teltonika Networks", "product": "OXA", "versions": [{"status": "affected", "version": "7.22", "lessThan": "7.24.6", "versionType": "OXA"}], "defaultStatus": "unaffected"}, {"vendor": "Teltonika Networks", "product": "DAP", "versions": [{"status": "affected", "version": "7.22", "lessThan": "7.24.6", "versionType": "DAP"}], "defaultStatus": "unaffected"}, {"vendor": "Teltonika Networks", "product": "TRB", "versions": [{"status": "affected", "version": "7.22", "lessThan": "7.24.6", "versionType": "TRB"}], "defaultStatus": "unaffected"}, {"vendor": "Teltonika Networks", "product": "OTD", "versions": [{"status": "affected", "version": "7.22", "lessThan": "7.24.6", "versionType": "OTD"}], "defaultStatus": "unaffected"}, {"vendor": "Teltonika Networks", "product": "EBG", "versions": [{"status": "affected", "version": "7.22", "lessThan": "7.24.6", "versionType": "EBG"}], "defaultStatus": "unaffected"}, {"vendor": "Teltonika Networks", "product": "SWM", "versions": [{"status": "affected", "version": "1.9", "lessThan": "1.10.4", "versionType": "SWM"}], "defaultStatus": "unaffected"}, {"vendor": "Teltonika Networks", "product": "TSW", "versions": [{"status": "affected", "version": "1.9", "lessThan": "1.10.4", "versionType": "TSW"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-13T07:16:32.573", "references": [{"url": "https://www.teltonika-networks.com/support/security-centre?report=CVE-2026-75826++", "source": "001d69cf-3fc9-4203-93fb-9865b54e05b2"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "001d69cf-3fc9-4203-93fb-9865b54e05b2", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 before 1.10.4 (TSW and SWM devices) allows a remote authenticated attacker to execute arbitrary OS commands."}], "lastModified": "2026-10-16T19:56:15.773", "sourceIdentifier": "001d69cf-3fc9-4203-93fb-9865b54e05b2"}

CVE-2026-75826

JSON object

Attach tags to CVE-2026-75826

Attach tags to `CVE-2026-75826`