Vulnerability · Published Dec 10, 2024 · Assigned by tlt_net
CVE-2024-8256Incorrect Permission Assignment in RutOS based routers and TSWOS based managed switches
Medium 5.9
In plain English
A medium-severity incorrect permission assignment in RUTOS from Teltonika Networks. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Severity (CVSS 4.0)5.9Medium
Exploit odds (30 days)0.2%top 90.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
In Teltonika Networks RUTOS devices, running on versions 7.0 to 7.8 (excluding) and TSWOS devices running on versions 1.0 to 1.3 (excluding), due to incorrect permission handling a vulnerability exists which allows a lower privileged user with default permissions to access critical device resources via the API.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Teltonika Networks | RUTOS | 7.0 – before 7.8 |
| Teltonika Networks | TSWOS | 1.0 – before 1.3 |
Weakness: CWE-732 · Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N