CVE-2026-75826: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') in Teltonika Networks RUT

This vulnerability (CVE-2026-75826) involves improper neutralization of special elements used in an OS command (CWE-78) within the backup function of Teltonika Networks RUTOS and TSWOS firmware. It affects RUTOS versions 7.22 before 7.24.6 and 7.25 before 7.25.2 across various device models (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, EBG), RUTOS 7.22 before 7.25.2 on TAP devices, and TSWOS 1.9 before 1.10.4 on TSW and SWM devices. An authenticated attacker with high privileges can exploit this flaw to execute arbitrary OS commands remotely, potentially compromising device integrity and control.

Successful exploitation allows a remote authenticated attacker with high privileges to execute arbitrary operating system commands on affected devices. This can lead to full compromise of the device, unauthorized control, and disruption of normal operations. The vulnerability does not require user interaction but does require authentication with elevated privileges.

Patch status is not yet confirmed from the provided data; check the vendor advisory for current remediation guidance. Until patches are applied, restrict access to the backup function to trusted administrators only and monitor for suspicious activity. Apply updates promptly once official fixes are released by Teltonika Networks.