CVE-2026-8914: Teltonika Networks RCE Vulnerability

CVE-2026-8914 Overview

CVE-2026-8914 is a command injection vulnerability affecting Teltonika Networks RUTOS and TSWOS devices. The flaw resides in the rpc-profile component, which makes unsafe calls to an eval function. A lower-privileged authenticated user can inject arbitrary commands that execute as the root user. This results in full compromise of the affected network device.

The vulnerability is classified under CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code. It affects RUTOS firmware versions 7.22 through 7.23.2 and TSWOS versions 1.09 through 1.09.1.

Critical Impact
An authenticated low-privileged user can escalate to root through command injection in rpc-profile, gaining complete control over affected Teltonika RUTOS and TSWOS devices.

Affected Products

Teltonika Networks RUTOS devices, versions 7.22 through 7.23.2
Teltonika Networks TSWOS devices, versions 1.09 through 1.09.1
The vulnerable rpc-profile component shipped with the above firmware releases

Discovery Timeline

2026-06-05 - CVE-2026-8914 published to NVD
2026-06-05 - Last updated in NVD database

Technical Details for CVE-2026-8914

Vulnerability Analysis

The vulnerability stems from unsafe use of an eval function within the rpc-profile component on Teltonika RUTOS and TSWOS devices. The eval construct dynamically interprets input as code, and when attacker-controllable data flows into this sink without sanitization, arbitrary commands execute in the calling process context.

In this case, rpc-profile runs with elevated privileges. Commands evaluated through this path execute as root, regardless of the calling user's privilege level. The result is a vertical privilege escalation chained from a command injection primitive.

The issue maps to [CWE-95], a class of vulnerabilities caused by passing untrusted input to dynamic code evaluation functions. Mitigation typically requires removing the eval call, switching to parameterized command execution, or strictly allowlisting inputs before evaluation.

Root Cause

The root cause is improper neutralization of directives passed to a dynamically evaluated code function. The rpc-profile handler accepts input from authenticated users and passes it to eval without validating, escaping, or restricting the content. Because the handler runs with root privileges, any injected payload executes with the same authority.

Attack Vector

The attack requires local access with valid low-privileged credentials. An authenticated attacker submits a crafted profile-related RPC request containing shell metacharacters or command separators. The rpc-profile component evaluates the payload, executing the injected commands as root.

No user interaction is required beyond the attacker's authenticated session. Refer to the Teltonika Security Centre for vendor advisory details.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-8914

Indicators of Compromise

Unexpected processes spawned by the rpc-profile service or its parent UCI/RPC daemon on RUTOS or TSWOS devices
New or modified files in root-writable directories such as /etc/, /tmp/, or /overlay/ following profile-related RPC activity
Outbound connections from the device to unfamiliar hosts shortly after authenticated low-privileged sessions
Unauthorized SSH key additions, cron jobs, or init script changes that survive reboot

Detection Strategies

Inspect RPC request logs for profile-related calls containing shell metacharacters such as ;, |, `, $(), or newline sequences
Correlate authentication events for low-privileged users with subsequent root-context process executions
Monitor firmware integrity by comparing file hashes of system binaries and configuration files against known-good baselines
Apply behavioral analytics to detect privilege transitions from non-root users to root through rpc-profile execution paths

Monitoring Recommendations

Forward syslog and authentication logs from RUTOS and TSWOS devices to a centralized SIEM for retention and correlation
Alert on any creation of new local accounts, SSH keys, or scheduled tasks on edge network devices
Track configuration drift on Teltonika devices using out-of-band management telemetry
Restrict and log network access to device management interfaces, including the LuCI web UI and RPC endpoints

How to Mitigate CVE-2026-8914

Immediate Actions Required

Inventory all Teltonika RUTOS devices on firmware 7.22 through 7.23.2 and TSWOS devices on 1.09 through 1.09.1
Restrict management plane access to trusted administrative networks and remove exposure to untrusted segments
Rotate credentials for all low-privileged accounts that can reach rpc-profile functionality
Review device logs for signs of prior exploitation, including unexpected root-context activity

Patch Information

Consult the Teltonika Security Centre for the fixed firmware versions and release notes. Apply the vendor-provided firmware updates that remediate the unsafe eval usage in rpc-profile as soon as they are available for your device model.

Workarounds

Limit access to the RPC and profile management interfaces to administrative accounts only, removing capability from lower-privileged roles where feasible
Place affected devices behind a management VLAN or jump host to prevent direct authenticated access from general users
Disable or restrict the rpc-profile functionality through device configuration if your deployment does not require it
Enforce strong, unique credentials and multi-factor authentication where supported to reduce the risk of low-privileged account compromise

bash

# Configuration example: restrict management access to a trusted subnet
uci set firewall.@zone[1].input='DROP'
uci add firewall rule
uci set firewall.@rule[-1].name='Allow-Mgmt-From-Trusted'
uci set firewall.@rule[-1].src='wan'
uci set firewall.@rule[-1].src_ip='10.10.0.0/24'
uci set firewall.@rule[-1].dest_port='80 443 22'
uci set firewall.@rule[-1].target='ACCEPT'
uci commit firewall
/etc/init.d/firewall restart