CVE-2023-32350 (rut200_firmware, rut240_firmware, rut241_firmware, rut300_firmware, rut360_firmware, rut901_firmware, rut950_firmware, rut951_firmware, rut955_firmware, rut956_firmware, rutx08_firmware, rutx09_firmware, rutx10_firmware, rutx11_firmwa

Versions 00.07.00 through 00.07.03 of Teltonika’s RUT router firmware contain an operating system (OS) command injection vulnerability in a Lua service. An attacker could exploit a parameter in the vulnerable function that calls a user-provided package name by instead providing a package with a malicious name that contains an OS command injection payload.

command command injection cve exploit firmware function injection lua malicious name operating system package parameter router service system vulnerability vulnerable