CVE-2023-32350 Command injection in RUT model routers
Attackers can execute arbitrary OS commands on Teltonika RUT routers by injecting payloads into a Lua service parameter.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-32350?
CVE-2023-32350 is a high-severity command injection vulnerability in Teltonika RUT model routers, published on 22 May 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Versions 00.07.00 through 00.07.03 of Teltonika’s RUT router firmware contain an operating system (OS) command injection vulnerability in a Lua service. An attacker could exploit a parameter in the vulnerable function that calls a user-provided package name by instead providing a package with a malicious name that contains an OS command injection payload.
Weakness: CWE-78
Which versions are affected by CVE-2023-32350?
It affects 18 products.
Products include Teltonika-Networks Rut200 Firmware, Teltonika-Networks Rut240 Firmware, Teltonika-Networks Rut241 Firmware, Teltonika-Networks Rut300 Firmware, Teltonika-Networks Rut360 Firmware, Teltonika-Networks Rut901 Firmware and 12 more.
How do I fix CVE-2023-32350?
No fix has been published for CVE-2023-32350 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-32350 being exploited?
There is no known exploitation of CVE-2023-32350 in the wild and no public exploit code.
Other vulnerabilities in Teltonika RUT model routers
Sources
Also known as GHSA-r3cr-jc72-pwfx.