Vulnerability · Published Oct 30, 2026 · Assigned by tlt_net
CVE-2026-82104API permission bypass via logic bug
Critical 9.4
In plain English
A critical-severity missing authentication in ATRM from Teltonika Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Official description
In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to those requests not following proper flows, this could lead to OS command execution. This issue affects RUT: from 7.22 through 7.24.2; RUTX: from 7.22 through 7.24.2; RUTM: from 7.22 through 7.24.2; RUTC: from 7.22 through 7.24.2; ATRM: from 7.22 through 7.24.2; TAP: from 7.22 through 7.24.2; CAP: from 7.22 through 7.24.2; OXA: from 7.22 through 7.24.2; DAP: from 7.22 through 7.24.2; TRB: from 7.22 through 7.24.2; OTD: from 7.22 through 7.24.2; EBG: from 7.22 through 7.24.2; SWM: from 1.9 through 1.10; TSW: from 1.9 through 1.10.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Teltonika Networks | RUT | 7.22 – through 7.24.2 |
| Teltonika Networks | RUTX | 7.22 – through 7.24.2 |
| Teltonika Networks | RUTM | 7.22 – through 7.24.2 |
| Teltonika Networks | RUTC | 7.22 – through 7.24.2 |
| Teltonika Networks | ATRM | 7.22 – through 7.24.2 |
| Teltonika Networks | TAP | 7.22 – through 7.24.2 |
| Teltonika Networks | CAP | 7.22 – through 7.24.2 |
| Teltonika Networks | OXA | 7.22 – through 7.24.2 |
| Teltonika Networks | DAP | 7.22 – through 7.24.2 |
| Teltonika Networks | TRB | 7.22 – through 7.24.2 |
| Teltonika Networks | OTD | 7.22 – through 7.24.2 |
| Teltonika Networks | EBG | 7.22 – through 7.24.2 |
| Teltonika Networks | SWM | 1.9 – through 1.10 |
| Teltonika Networks | TSW | 1.9 – through 1.10 |
Weakness: CWE-306 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H