CVE-2026-8914— Command injection in Profile change function
Possible ATT&CK Techniques 3AI
T1136.002 · Domain Account T1059.004 · Unix Shell T1068 · Exploitation for Privilege EscalationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Teltonika Networks | RUTOS | 7.22≤ 7.23.2 | affected |
| Teltonika Networks | TSWOS | 1.09≤ 1.09.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-8914
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Command injection in Profile change function
Source: NVD (National Vulnerability Database)
Vulnerability Description
In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1, due to unsafe calls to an eval function in rpc-profile, a vulnerability exists where a lower privileged user could perform command injection as the root user.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
动态执行代码中指令转义处理不恰当(Eval注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Teltonika RUTOS 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Teltonika RUTOS是Teltonika公司的一个基于 OpenWrt 的统一操作系统。 Teltonika RUTOS 7.22版本至7.23.2版本和TSWOS 1.09版本至1.09.1版本存在安全漏洞，该漏洞源于rpc-profile中eval函数的不安全调用，可能导致低权限用户以root用户身份执行命令注入。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Teltonika Networks | RUTOS | 7.22 ~ 7.23.2 | - | |
| Teltonika Networks | TSWOS | 1.09 ~ 1.09.1 | - |
II. Public POCs for CVE-2026-8914
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-8914
请登录查看更多情报信息。
Vendor Pages for CVE-2026-8914 (1)
IV. Related Vulnerabilities
Same weakness: CWE-95
- CVE-2026-45406
Dokku: Host RCE via Maliciously Named OpenResty Include File - CVE-2025-71361
picklescan - Remote Code Execution via Undetected idlelib.ca - CVE-2026-44939
Command injection through unsanitized YAML parameter in Ranc - CVE-2026-53875
picklescan - Scanning Bypass via Dynamic Eval in scan_pytorc - CVE-2026-47103
Python StateMachine 3.0.0 < 3.2.0 RCE via SCXML eval() Injec
V. Comments for CVE-2026-8914
No comments yet