CVE-2018-17532

Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vulnerabilities in autologin.cgi and hotspotlogin.cgi due to insufficient user input sanitization. This allows remote attackers to execute arbitrary commands with root privileges.

• CWE-78

• http://packetstormsecurity.com/files/149777/Teltonika-RUT9XX-Unauthenticated-OS-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2018/Oct/27Exploit, Mailing List, Third Party Advisory
• https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180319-01_Teltonika_OS_Command_InjectionExploit, Third Party Advisory
• http://packetstormsecurity.com/files/149777/Teltonika-RUT9XX-Unauthenticated-OS-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2018/Oct/27Exploit, Mailing List, Third Party Advisory
• https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180319-01_Teltonika_OS_Command_InjectionExploit, Third Party Advisory

Published

Oct 15, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-17499Envoy Passport for Android and Envoy Passport for iPhone cou…2.9
• CVE-2018-1750IBM Security Key Lifecycle Manager 3.0 specifies permissions…4.2
• CVE-2018-17500Envoy Passport for Android and Envoy Passport for iPhone cou…2.9
• CVE-2018-17502The Receptionist for iPad could allow a local attacker to ob…4
• CVE-2018-1751IBM Security Key Lifecycle Manager 3.0 through 3.0.0.2 uses …5.9
• CVE-2018-1753IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 generates…4.3
• CVE-2018-17533Teltonika RUT9XX routers with firmware before 00.05.01.1 are…
• CVE-2018-17534Teltonika RUT9XX routers with firmware before 00.04.233 prov…
• CVE-2018-17536An issue was discovered in GitLab Community and Enterprise E…5.4
• CVE-2018-17537An issue was discovered in GitLab Community and Enterprise E…5.4
• CVE-2018-17538Axon (formerly TASER International) Evidence Sync 3.15.89 is…
• CVE-2018-17539The BGP daemon (bgpd) in all IP Infusion ZebOS versions to 7…