CVE-2023-32349
📋 TL;DR
This vulnerability allows authenticated attackers to modify validation variables in Teltonika RUT router firmware, enabling malicious parameters in the packet dump utility that can lead to arbitrary code execution. It affects organizations using Teltonika RUT routers with firmware version 00.07.03.4 or earlier.
💻 Affected Systems
- Teltonika RUT series routers
📦 What is this software?
Rut200 Firmware by Teltonika Networks
Rut240 Firmware by Teltonika Networks
Rut241 Firmware by Teltonika Networks
Rut300 Firmware by Teltonika Networks
Rut360 Firmware by Teltonika Networks
Rut901 Firmware by Teltonika Networks
Rut950 Firmware by Teltonika Networks
Rut951 Firmware by Teltonika Networks
Rut955 Firmware by Teltonika Networks
Rut956 Firmware by Teltonika Networks
Rutx08 Firmware by Teltonika Networks
Rutx09 Firmware by Teltonika Networks
Rutx10 Firmware by Teltonika Networks
Rutx11 Firmware by Teltonika Networks
Rutx12 Firmware by Teltonika Networks
Rutx14 Firmware by Teltonika Networks
Rutx50 Firmware by Teltonika Networks
Rutxr1 Firmware by Teltonika Networks
⚠️ Risk & Real-World Impact
Worst Case
Full router compromise allowing attacker to intercept/modify network traffic, pivot to internal networks, and establish persistent access.
Likely Case
Router takeover enabling traffic monitoring, credential theft, and lateral movement within the network.
If Mitigated
Limited impact if strong authentication controls prevent unauthorized access to the UCI configuration utility.
🎯 Exploit Status
Requires authenticated access and knowledge of UCI configuration utility manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 00.07.03.4
Vendor Advisory: https://wiki.teltonika-networks.com/view/RUTX11_Firmware_Downloads
Restart Required: Yes
Instructions:
1. Download latest firmware from Teltonika support portal. 2. Log into router web interface. 3. Navigate to System > Backup/Flash Firmware. 4. Upload new firmware file. 5. Wait for automatic reboot.
🔧 Temporary Workarounds
Disable UCI configuration utility
linuxRemove or disable access to the vulnerable UCI configuration interface
uci delete network.wan
uci commit
service network restart
Restrict management interface access
linuxLimit access to router management interface to trusted IPs only
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate routers from critical assets
- Enable multi-factor authentication for router management interfaces
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface: System > Overview > Firmware VersionCheck Version:
cat /etc/os-release | grep VERSIONVerify Fix Applied:
Verify firmware version is above 00.07.03.4 and test UCI configuration changes are properly validated📡 Detection & Monitoring
Log Indicators:
- Unexpected UCI configuration changes
- Unauthorized access to /usr/sbin/packetdump
- Suspicious process execution from packet dump utility
Network Indicators:
- Unusual outbound connections from router
- Traffic redirection patterns
- DNS hijacking attempts
SIEM Query:
source="router.log" AND ("uci set" OR "packetdump") AND NOT user="admin"