CVE-2026-75826

Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 before 1.10.4 (TSW and SWM devices) allows a remote authenticated attacker to execute arbitrary OS commands.

An authenticated attacker with network access can execute arbitrary OS commands on the device, potentially leading to full control of the router or switch and network traffic.

Update RUTOS to version 7.24.6 or 7.25.2 (or later) and TSWOS to version 1.10.4 (or later); until then, restrict access to the management interface.