CVE-2026-8914

Command injection in Profile change function

Published Jun 5, 2026 CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Description

In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1, due to unsafe calls to an eval function in rpc-profile, a vulnerability exists where a lower privileged user could perform command injection as the root user.

Analysis

Technical impact

The vulnerability arises from unsafe eval calls in the rpc-profile component, allowing a lower privileged user to construct and execute arbitrary shell commands with root privileges. This flaw is a classic command injection problem categorized as CWE‑95, giving an attacker complete control over the system once exploited.

Affected Systems

Teltonika Networks RUTOS firmware versions 7.22 through 7.23.2 and TSWOS firmware versions 1.09 through 1.09.1 are affected. These devices run the rpc-profile service which is accessible to users with limited rights.

Risk and Exploitability

The CVSS score of 8.4 reflects a high impact and considerable exploitation difficulty. No EPSS score is available, and the vulnerability is not listed in KEV. The attack vector is inferred to be local or remote through the rpc‑profile API, requiring the attacker to have a user account with lower privileges but the ability to invoke rpc-profile calls. Successful exploitation yields full root access, compromising confidentiality, integrity and availability of the device.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Teltonika Networks

RUTOS

unaffected

Version	Status	Constraints
`7.22`	affected	≤ 7.23.2

Teltonika Networks

TSWOS

unaffected

Version	Status	Constraints
`1.09`	affected	≤ 1.09.1

No data.

Vendor Product Versions

Teltonika-networks

Rutos

Version	Status	Scheme	Platform
`[7.22,7.23.2]`	affected	generic	—

Teltonika-networks

Tswos

Version	Status	Scheme	Platform
`[1.09,1.09.1]`	affected	generic	—

Remediation

Vendor Solution

Update to RUTOS 7.23.3 or later.

OpenCVE Recommended Actions

Apply the vendor‑provided firmware upgrade to RUTOS 7.23.3 or later and TSWOS 1.10 or later.
Restrict non‑admin users from accessing rpc‑profile functions and enforce strict role‑based access control.
Enable detailed logging for rpc‑profile command execution and monitor logs for abnormal activity.

Generated by OpenCVE AI on June 5, 2026 at 11:26 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.541% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.teltonika-networks.com/support/security-centre

History

Jun 7, 2026 11:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Teltonika-networks Teltonika-networks rutos Teltonika-networks tswos
Vendors & Products		Teltonika-networks Teltonika-networks rutos Teltonika-networks tswos

Jun 5, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 5, 2026 10:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1, due to unsafe calls to an eval function in rpc-profile, a vulnerability exists where a lower privileged user could perform command injection as the root user.
Title		Command injection in Profile change function
Weaknesses		CWE-95
References		https://www.teltonika-networks.com/support/security-centre
Metrics		cvssV4_0 `{'score': 8.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`