Command injection in the backup function of various Teltonika Networks devices allows an authenticated attacker to execute arbitrary operating‑system commands on the device. This flaw is a CWE‑78 vulnerability and can lead to total loss of confidentiality, integrity, and availability.

Affected vendors and products include Teltonika Networks RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG running RUTOS 7.22 before 7.24.6 or RUTOS 7.25 before 7.25.2; TAP devices running RUTOS 7.22 before 7.25.2; and TSW and SWM devices running TSWOS 1.9 before 1.10.4.

The CVSS score of 8.5 indicates high severity, and the absence of an EPSS score makes it unclear how frequently the vulnerability is exploited, though it is not listed in CISA’s KEV catalog. The attack requires the attacker to be authenticated to the device and to invoke the backup feature, after which arbitrary OS commands can be run.