OS Command Injection in TELTONIKA products - CVE-2023-32350

Vulnerability identifier: #VU76157

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-32350

CWE-ID: CWE-78

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in a Lua service. A remote attacker on the local network can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

RUT200
RUT950
RUT951
RUT901
RUT850
RUT360
RUT955
RUT300
RUT241
RUT240
RUT230
RUT956

Install updates from vendor's website.

RUT200 - update to 00.07.03.1
RUT950 - update to 00.07.03.1
RUT951 - update to 00.07.03.1
RUT901 - update to 00.07.03.1
RUT850 - update to 00.07.03.1
RUT360 - update to 00.07.03.1
RUT955 - update to 00.07.03.1
RUT300 - update to 00.07.03.1
RUT241 - update to 00.07.03.1
RUT240 - update to 00.07.03.1
RUT230 - update to 00.07.03.1
RUT956 - update to 00.07.03.1

• https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08

• OS Command Injection in Teltonika RUT Model Routers