CVE-2017-8116

The management interface for the Teltonika RUT9XX routers (aka LuCI) with firmware 00.03.265 and earlier allows remote attackers to execute arbitrary commands with root privileges via shell metacharacters in the username parameter in a login request.

• CWE-78

• https://github.com/nettitude/metasploit-modules/blob/master/teltonika_add_user.rbExploit, Third Party Advisory
• https://github.com/nettitude/metasploit-modules/blob/master/teltonika_cmd_exec.rbExploit, Third Party Advisory
• https://labs.nettitude.com/blog/cve-2017-8116-teltonika-router-unauthenticated-remote-code-execution/Third Party Advisory
• https://github.com/nettitude/metasploit-modules/blob/master/teltonika_add_user.rbExploit, Third Party Advisory
• https://github.com/nettitude/metasploit-modules/blob/master/teltonika_cmd_exec.rbExploit, Third Party Advisory
• https://labs.nettitude.com/blog/cve-2017-8116-teltonika-router-unauthenticated-remote-code-execution/Third Party Advisory

Published

Jul 3, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-8108Unspecified tests in Lynis before 2.5.0 allow local users to…
• CVE-2017-8109The salt-ssh minion code in SaltStack Salt 2016.11 before 20…
• CVE-2017-8110www.modified-shop.org modified eCommerce Shopsoftware 2.0.2.…10
• CVE-2017-8112hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows loc…6.5
• CVE-2017-8114Roundcube Webmail allows arbitrary password resets by authen…8.8
• CVE-2017-8115Directory traversal in setup/processors/url_search.php (aka …
• CVE-2017-8117The UMA product with software V200R001 and V300R001 has a pr…
• CVE-2017-8118The UMA product with software V200R001 and V300R001 has an i…
• CVE-2017-8119The UMA product with software V200R001 and V300R001 has a pr…
• CVE-2017-8120The UMA product with software V200R001 and V300R001 has a pr…
• CVE-2017-8121The UMA product with software V200R001 and V300R001 has an i…
• CVE-2017-8122The UMA product with software V200R001 has a privilege eleva…