CVE-2023-32349

Version 00.07.03.4 and prior of Teltonikas RUT router firmware contain a packet dump utility that contains proper validation for filter parameters. However, variables for validation checks are stored in an external configuration file. An authenticated attacker could use an exposed UCI configuration utility to change these variables and enable malicious parameters in the dump utility, which could result in arbitrary code execution.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8 HIGH
ADJACENT_NETWORK
LOW
LOW
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
icscertCNA
8 HIGH
ADJACENT_NETWORK
LOW
LOW
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 20%
VendorProductVersion
teltonika-networksrut200_firmware
𝑥
≤ 00.07.03.4
teltonika-networksrut240_firmware
𝑥
≤ 00.07.03.4
teltonika-networksrut241_firmware
𝑥
≤ 00.07.03.4
teltonika-networksrut300_firmware
𝑥
≤ 00.07.03.4
teltonika-networksrut360_firmware
𝑥
≤ 00.07.03.4
teltonika-networksrut901_firmware
𝑥
≤ 00.07.03.4
teltonika-networksrut950_firmware
𝑥
≤ 00.07.03.4
teltonika-networksrut951_firmware
𝑥
≤ 00.07.03.4
teltonika-networksrut955_firmware
𝑥
≤ 00.07.03.4
teltonika-networksrut956_firmware
𝑥
≤ 00.07.03.4
teltonika-networksrutx08_firmware
𝑥
≤ 00.07.03.4
teltonika-networksrutx09_firmware
𝑥
≤ 00.07.03.4
teltonika-networksrutx10_firmware
𝑥
≤ 00.07.03.4
teltonika-networksrutx11_firmware
𝑥
≤ 00.07.03.4
teltonika-networksrutx12_firmware
𝑥
≤ 00.07.03.4
teltonika-networksrutx14_firmware
00.07.00 ≤
𝑥
≤ 00.07.03.4
teltonika-networksrutx50_firmware
00.07.00 ≤
𝑥
≤ 00.07.03.4
teltonika-networksrutxr1_firmware
00.07.00 ≤
𝑥
≤ 00.07.03.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08
https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08