CVE-2023-31728
📋 TL;DR
Teltonika RUT240 devices with vulnerable firmware expose SSH and HTTP services on IPv6 WAN interfaces when bridge mode is enabled, despite UI indications they're LAN-only. This allows unauthorized remote access to network management interfaces. Affected users are those running RUT240 devices in bridge mode with IPv6 enabled.
💻 Affected Systems
- Teltonika RUT240
📦 What is this software?
Rut240 Firmware by Teltonika Networks
⚠️ Risk & Real-World Impact
Worst Case
Remote attackers gain administrative access to the device, enabling network compromise, credential theft, and lateral movement into connected networks.
Likely Case
Unauthorized users discover and access management interfaces, potentially changing configurations or gathering network information.
If Mitigated
With proper network segmentation and access controls, exposure is limited to management interface access only.
🎯 Exploit Status
Exploitation requires discovering exposed IPv6 addresses and attempting SSH/HTTP access
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 07.04.2
Vendor Advisory: https://wiki.teltonika-networks.com/view/RUT240_Firmware_Changelog
Restart Required: Yes
Instructions:
1. Log into RUT240 web interface. 2. Navigate to System → Firmware. 3. Upload firmware version 07.04.2. 4. Apply update and reboot device.
🔧 Temporary Workarounds
Disable IPv6 on WAN interface
allPrevents exposure of services on IPv6 WAN interface
Disable bridge mode
allSwitch to router mode to avoid the vulnerability
🧯 If You Can't Patch
- Implement strict firewall rules blocking external access to SSH (port 22) and HTTP (port 80/443)
- Use network segmentation to isolate RUT240 devices from critical infrastructure
🔍 How to Verify
Check if Vulnerable:
Check if SSH or HTTP services respond on IPv6 WAN addresses when bridge mode is enabledCheck Version:
ssh admin@device_ip 'cat /etc/version' or check web interface System → StatusVerify Fix Applied:
Verify services no longer respond on IPv6 WAN interface after update📡 Detection & Monitoring
Log Indicators:
- Unauthorized SSH/HTTP access attempts from external IPv6 addresses
- Configuration changes from unexpected sources
Network Indicators:
- Unexpected SSH/HTTP traffic on IPv6 WAN interface
- Port scans targeting device IPv6 addresses
SIEM Query:
source_ip IN (external_ips) AND dest_port IN (22,80,443) AND protocol=tcp AND dest_ip LIKE 'fe80::%'