CVE-2026-8914CWE-95
Command injection in Profile change function
High · published June 5, 2026
What it is
In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1, due to unsafe calls to an eval function in rpc-profile, a vulnerability exists where a lower privileged user could perform command injection as the root user.
The record
Technical detail
- CVSS v4.0
- 8.4 · HIGH
- Vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS
- 0.00618 · 48.9th percentile
- Weakness
- CWE-95 · Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
- Published
- 2026-06-05T09:36Z
EPSS history
Timeline