VulnerabilityModified

CVE-2018-17532

Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vulnerabilities in autologin.cgi and hotspotlogin.cgi due to insufficient user input sanitization.

CRITICAL 9.8EPSS 70.7%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 70.7%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

CVSS 3.0: 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 70.66% probability · 99th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-78
Affected: teltonika/rut900 firmware · teltonika/rut950 firmware · teltonika/rut955 firmware
Source: cve@mitre.org

EPSS trend

EPSS moved from 60.0% on 21 September 2026 to 70.7% on 27 October 2026. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”.

References

http://packetstormsecurity.com/files/149777/Teltonika-RUT9XX-Unauthenticated-OS-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2018/Oct/27Exploit, Mailing List, Third Party Advisory
https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180319-01_Teltonika_OS_Command_InjectionExploit, Third Party Advisory
http://packetstormsecurity.com/files/149777/Teltonika-RUT9XX-Unauthenticated-OS-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2018/Oct/27Exploit, Mailing List, Third Party Advisory
https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180319-01_Teltonika_OS_Command_InjectionExploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.