Teltonika's vulnerability profile centers on a focused line of industrial and remote-access networking devices, including routers and management platforms, that occupy critical infrastructure and enterprise edge positions. Vulnerabilities affecting the vendor skew strongly toward critical-severity outcomes and recur through weakness classes including improper authentication, OS command injection, cross-site scripting, and excessive-authentication-bypass conditions that are characteristic of management interfaces exposed to untrusted networks. Defenders should treat this vendor's advisories as high-priority for internet-facing or remote-accessible instances; current exploitation activity and severity counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Teltonika over time
Signals from CVEs in this vendor scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-17532CRITICAL Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vulnerabilities in autologin.cgi and hotspotlogin.cgi due to insu | Oct 15, 2018 | 9.8 | 70 | NO | NO |
CVE-2017-8116CRITICAL The management interface for the Teltonika RUT9XX routers (aka LuCI) with firmware 00.03.265 and earlier allows remote attackers to execute arbitrary commands with root privileges | Jul 3, 2017 | 9.8 | 31 | NO | NO |
CVE-2023-2586CRITICAL
Teltonika’s Remote Management System versions 4.14.0 is vulnerable to an unauthorized attacker registering previously unregistered devices through the RMS platform. If the user ha | May 22, 2023 | 9.8 | 29 | NO | NO |
CVE-2023-32347CRITICAL
Teltonika’s Remote Management System versions prior to 4.10.0 use device serial numbers and MAC addresses to identify devices from the user perspective for device claiming and fro | May 22, 2023 | 9.8 | 29 | NO | NO |
CVE-2018-19879CRITICAL An issue was discovered in /cgi-bin/luci on Teltonika RTU9XX (e.g., RUT950) R_31.04.89 before R_00.05.00.5 devices. The authentication functionality is not protected from automated | Mar 28, 2019 | 9.8 | 29 | NO | NO |
CVE-2023-2588HIGH
Teltonika’s Remote Management System versions prior to 4.10.0 have a feature allowing users to access managed devices’ local secure shell (SSH)/web management services over the cl | May 22, 2023 | 8.8 | 26 | NO | NO |
CVE-2023-2587HIGH
Teltonika’s Remote Management System versions prior to 4.10.0 contain a cross-site scripting (XSS) vulnerability in the main page of the web interface. An attacker with the MAC ad | May 22, 2023 | 8.3 | 26 | NO | NO |
CVE-2024-22727HIGH Teltonika TRB1-series devices with firmware before TRB1_R_00.07.05.2 allow attackers to exploit a firmware vulnerability via Ethernet LAN or USB. | Feb 17, 2024 | 8.3 | 23 | NO | NO |
CVE-2018-17534MEDIUM Teltonika RUT9XX routers with firmware before 00.04.233 provide a root terminal on a serial interface without proper access control. This allows attackers with physical access to e | Oct 15, 2018 | 6.8 | 23 | NO | NO |
CVE-2018-17533MEDIUM Teltonika RUT9XX routers with firmware before 00.05.01.1 are prone to cross-site scripting vulnerabilities in hotspotlogin.cgi due to insufficient user input sanitization. | Oct 15, 2018 | 6.1 | 22 | NO | NO |
Signals from CVEs in this vendor scope (13 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Teltonika.
Media articles that mention a CVE ID that affects a product developed by Teltonika — matched by CVE ID, not by vendor name.