{"api_version":"1","generated_at":"2026-10-28T00:22:07+00:00","cve":"CVE-2026-75826","urls":{"html":"https://cve.report/CVE-2026-75826","api":"https://cve.report/api/cve/CVE-2026-75826.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-75826","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-75826"},"summary":{"title":"Teltonika Command Injection in Backup function","description":"Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 before 1.10.4 (TSW and SWM devices) allows a remote authenticated attacker to execute arbitrary OS commands.","state":"PUBLISHED","assigner":"tlt_net","published_at":"2026-10-13 07:16:32","updated_at":"2026-10-16 19:56:15"},"problem_types":["CWE-78","CWE-78 CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')"],"metrics":[{"version":"4.0","source":"001d69cf-3fc9-4203-93fb-9865b54e05b2","type":"Secondary","score":"8.5","severity":"HIGH","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"CVSS","score":"8.5","severity":"HIGH","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","data":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","baseScore":8.5,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}}],"references":[{"url":"https://www.teltonika-networks.com/support/security-centre?report=CVE-2026-75826++","name":"https://www.teltonika-networks.com/support/security-centre?report=CVE-2026-75826++","refsource":"001d69cf-3fc9-4203-93fb-9865b54e05b2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75826","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75826","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Teltonika Networks","product":"RUT","version":"affected 7.22 7.24.6 RUT","platforms":[]},{"source":"CNA","vendor":"Teltonika Networks","product":"RUTX","version":"affected 7.22 7.24.6 RUTX","platforms":[]},{"source":"CNA","vendor":"Teltonika Networks","product":"RUTX","version":"affected 7.22 7.25.2 RUTX","platforms":[]},{"source":"CNA","vendor":"Teltonika Networks","product":"RUTM","version":"affected 7.22 7.24.6 RUTM","platforms":[]},{"source":"CNA","vendor":"Teltonika Networks","product":"RUTM","version":"affected 7.22 7.25.2 RUTM","platforms":[]},{"source":"CNA","vendor":"Teltonika Networks","product":"RUTC","version":"affected 7.22 7.24.6 RUTC","platforms":[]},{"source":"CNA","vendor":"Teltonika Networks","product":"ATRM","version":"affected 7.22 7.24.6 ATRM","platforms":[]},{"source":"CNA","vendor":"Teltonika Networks","product":"TAP","version":"affected 7.22 7.25.2 TAP","platforms":[]},{"source":"CNA","vendor":"Teltonika Networks","product":"CAP","version":"affected 7.22 7.24.6 CAP","platforms":[]},{"source":"CNA","vendor":"Teltonika Networks","product":"OXA","version":"affected 7.22 7.24.6 OXA","platforms":[]},{"source":"CNA","vendor":"Teltonika Networks","product":"DAP","version":"affected 7.22 7.24.6 DAP","platforms":[]},{"source":"CNA","vendor":"Teltonika Networks","product":"TRB","version":"affected 7.22 7.24.6 TRB","platforms":[]},{"source":"CNA","vendor":"Teltonika Networks","product":"OTD","version":"affected 7.22 7.24.6 OTD","platforms":[]},{"source":"CNA","vendor":"Teltonika Networks","product":"EBG","version":"affected 7.22 7.24.6 EBG","platforms":[]},{"source":"CNA","vendor":"Teltonika Networks","product":"SWM","version":"affected 1.9 1.10.4 SWM","platforms":[]},{"source":"CNA","vendor":"Teltonika Networks","product":"TSW","version":"affected 1.9 1.10.4 TSW","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, EBG: update to 7.24.6 or later on the 7.24 branch, or 7.25.2 or later on the 7.25 branch\n    TAP: update to 7.25.2 or later\nTSW, SWM: update to 1.10.4 or later","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"75826","cve":"CVE-2026-75826","epss":"0.009390000","percentile":"0.601960000","score_date":"2026-10-16","updated_at":"2026-10-17 00:14:15"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-75826","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-14T18:59:58.817850Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-14T19:00:22.708Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"RUT","vendor":"Teltonika Networks","versions":[{"lessThan":"7.24.6","status":"affected","version":"7.22","versionType":"RUT"}]},{"defaultStatus":"unaffected","product":"RUTX","vendor":"Teltonika Networks","versions":[{"lessThan":"7.24.6","status":"affected","version":"7.22","versionType":"RUTX"},{"lessThan":"7.25.2","status":"affected","version":"7.22","versionType":"RUTX"}]},{"defaultStatus":"unaffected","product":"RUTM","vendor":"Teltonika Networks","versions":[{"lessThan":"7.24.6","status":"affected","version":"7.22","versionType":"RUTM"},{"lessThan":"7.25.2","status":"affected","version":"7.22","versionType":"RUTM"}]},{"defaultStatus":"unaffected","product":"RUTC","vendor":"Teltonika Networks","versions":[{"lessThan":"7.24.6","status":"affected","version":"7.22","versionType":"RUTC"}]},{"defaultStatus":"unaffected","product":"ATRM","vendor":"Teltonika Networks","versions":[{"lessThan":"7.24.6","status":"affected","version":"7.22","versionType":"ATRM"}]},{"defaultStatus":"unaffected","product":"TAP","vendor":"Teltonika Networks","versions":[{"lessThan":"7.25.2","status":"affected","version":"7.22","versionType":"TAP"}]},{"defaultStatus":"unaffected","product":"CAP","vendor":"Teltonika Networks","versions":[{"lessThan":"7.24.6","status":"affected","version":"7.22","versionType":"CAP"}]},{"defaultStatus":"unaffected","product":"OXA","vendor":"Teltonika Networks","versions":[{"lessThan":"7.24.6","status":"affected","version":"7.22","versionType":"OXA"}]},{"defaultStatus":"unaffected","product":"DAP","vendor":"Teltonika Networks","versions":[{"lessThan":"7.24.6","status":"affected","version":"7.22","versionType":"DAP"}]},{"defaultStatus":"unaffected","product":"TRB","vendor":"Teltonika Networks","versions":[{"lessThan":"7.24.6","status":"affected","version":"7.22","versionType":"TRB"}]},{"defaultStatus":"unaffected","product":"OTD","vendor":"Teltonika Networks","versions":[{"lessThan":"7.24.6","status":"affected","version":"7.22","versionType":"OTD"}]},{"defaultStatus":"unaffected","product":"EBG","vendor":"Teltonika Networks","versions":[{"lessThan":"7.24.6","status":"affected","version":"7.22","versionType":"EBG"}]},{"defaultStatus":"unaffected","product":"SWM","vendor":"Teltonika Networks","versions":[{"lessThan":"1.10.4","status":"affected","version":"1.9","versionType":"SWM"}]},{"defaultStatus":"unaffected","product":"TSW","vendor":"Teltonika Networks","versions":[{"lessThan":"1.10.4","status":"affected","version":"1.9","versionType":"TSW"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 before 1.10.4 (TSW and SWM devices) allows a remote authenticated attacker to execute arbitrary OS commands.</p>"}],"value":"Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 before 1.10.4 (TSW and SWM devices) allows a remote authenticated attacker to execute arbitrary OS commands."}],"impacts":[{"capecId":"CAPEC-88","descriptions":[{"lang":"en","value":"CAPEC-88 OS Command Injection"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","baseScore":8.5,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-13T07:38:37.887Z","orgId":"001d69cf-3fc9-4203-93fb-9865b54e05b2","shortName":"tlt_net"},"references":[{"url":"https://www.teltonika-networks.com/support/security-centre?report=CVE-2026-75826++"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, EBG: update to 7.24.6 or later on the 7.24 branch, or 7.25.2 or later on the 7.25 branch<br>    TAP: update to 7.25.2 or later<br>TSW, SWM: update to 1.10.4 or later"}],"value":"RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, EBG: update to 7.24.6 or later on the 7.24 branch, or 7.25.2 or later on the 7.25 branch\n    TAP: update to 7.25.2 or later\nTSW, SWM: update to 1.10.4 or later"}],"source":{"discovery":"EXTERNAL"},"title":"Teltonika Command Injection in Backup function","x_generator":{"engine":"Vulnogram 1.0.4"}}},"cveMetadata":{"assignerOrgId":"001d69cf-3fc9-4203-93fb-9865b54e05b2","assignerShortName":"tlt_net","cveId":"CVE-2026-75826","datePublished":"2026-10-13T06:59:06.919Z","dateReserved":"2026-08-18T10:56:03.319Z","dateUpdated":"2026-10-14T19:00:22.708Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-13 07:16:32","lastModifiedDate":"2026-10-16 19:56:15","problem_types":["CWE-78","CWE-78 CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')"],"metrics":{"cvssMetricV40":[{"source":"001d69cf-3fc9-4203-93fb-9865b54e05b2","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T18:59:58.817850Z","id":"CVE-2026-75826","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"75826","Ordinal":"1","Title":"Teltonika Command Injection in Backup function","CVE":"CVE-2026-75826","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"75826","Ordinal":"1","NoteData":"Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 before 1.10.4 (TSW and SWM devices) allows a remote authenticated attacker to execute arbitrary OS commands.","Type":"Description","Title":"Teltonika Command Injection in Backup function"}]}}}