CVE-2026-8914: Command injection in Profile change function

Synopsis

Command injection in the profile change function (rpc-profile) affects Teltonika Networks RUTOS devices running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1. The vulnerability stems from unsafe use of an eval function call that fails to sanitize user input, allowing a low-privileged authenticated user to inject and execute arbitrary commands as root. Successful exploitation gives the attacker full root-level control over the device, including read and write access to all data and system configuration. HarborGuard is tracking the advisory for patch availability, as no fix version has been published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attack vector is local (AV:L), meaning the attacker needs an existing shell or process on the host rather than any over-the-network access.

• AuthenticationRequired

  A privileged account (PR:H) is required, meaning the attacker must already hold an admin or similarly elevated credential on the device before exploiting the vulnerability.

• Victim interactionNot required

  No victim interaction is needed (UI:N); the attacker can carry out the injection entirely on their own without involving another user.

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and does not depend on race conditions, special memory layouts, or other variable environmental factors.

Blast Radius

• A successful attacker executes arbitrary OS commands as root, gaining full control over the device's operating environment.
• All stored configuration data, credentials, and secrets held on the device are readable by the attacker.
• The attacker can modify persisted device configuration, including network routing rules, firewall policy, and user account definitions.
• The attacker can crash or restart any running service on the device, disrupting network connectivity or management functions.