CVE-2026-8914 HIGH

CVE-2026-8914: Command injection in Profile change function

Vendor Teltonika Networks

Product RUTOS

Weakness CWE-95 · Eval injection

Published June 5, 2026

Last update June 5, 2026

View on NVD All CVEs

CVSS base score

8.4/10

Attack vector Local

Attack complexity Low

Privileges required High

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1, due to unsafe calls to an eval function in rpc-profile, a vulnerability exists where a lower privileged user could perform command injection as the root user.

Key dates

02Disclosure timeline

June 5, 2026 CVE published

June 5, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-8914 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/95.html

Related vulnerabilities

Identifiers

CVE CVE-2026-8914

CWE CWE-95

CVSS 8.4 / HIGH

Affected versions

Vendor Teltonika Networks

Product RUTOS

Affected ≥ 7.22 and ≤ 7.23.2

Vendor Teltonika Networks

Product TSWOS

Affected ≥ 1.09 and ≤ 1.09.1

CVE-2026-8914: Command injection in Profile change function

01Description

02Disclosure timeline

03References

04Related CVE