CVE-2026-8914 — Command injection in Profile change function
In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1, due to unsafe calls to an eval function in rpc-…
Published: 2026-06-05 · CVSS: 8.4 · CVSS 4.0
In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1, due to unsafe calls to an eval function in rpc-profile, a vulnerability exists where a lower privileged user could perform command injection as the root user.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7