Teltonika Networks RUTOS and TSWOS devices contain a logic bug that allows an unauthenticated user to invoke arbitrary Lua functions through the API, bypassing all standard validation checks. This bypass can lead to execution of arbitrary operating‑system commands, resulting in full control over the device and the underlying network segment. The vulnerability is a high‑severity flaw that can compromise confidentiality, integrity, and availability of the affected device.

Affected products include Teltonika Networks RUT, RUTX, RUTM, RUTC, ATRM, TAP, CAP, OXA, DAP, TRB, OTD, EBG, SWM, and TSW. Firmware versions from 7.22 through 7.24.2 are vulnerable on RUTOS hardware, while TSWOS firmware versions 1.9 through 1.10 contain the same defect.

The CVSS score of 9.4 indicates critical severity, and the EPSS score of less than 1% suggests a very low exploitation probability; however, the absence of an authentication requirement gives an attacker a low barrier to launch attacks. With remote access to the API, an attacker can trigger the logic bug and immediately execute OS commands, placing the device under full remote control. The vulnerability is not yet listed in the CISA KEV catalog, but the potential impact warrants immediate remediation.