TELTONIKA NETWORKING DEVICES
Security Centre
Any device that is connected to the internet is subject to cyber-attacks. Here we provide all the information about any existing or potential security vulnerabilities related to our connectivity products.
Increased malware activity targeting OpenWrt-based devices
06/11/26
The cybersecurity landscape is currently seeing a marked rise in attacks on network edge devices. Our Security team has observed an increase in malware activity targeting OpenWrt-based systems, which include RutOS. Devices with remote management access enabled over WAN are at risk.
We encourage you to check that your devices are operating as expected, in particular for loss of WebUI access over WAN, unrecognised processes, unexpected crontab entries or configuration changes you did not make. If you notice anything unusual, even if you are not sure, please contact us via Helpdesk or the Report a Vulnerability form, including the device model and firmware version.
As always, we encourage you to follow the security hardening recommendations available on your device's Device security page in our Wiki (for example, RUTC50 Device security).
Security vulnerability CVE-2026-82104
30/10/26
We have disclosed a critical security vulnerability (CVE-2026-82104) affecting devices running RutOS versions 7.22–7.24.2 and TswOS versions 1.9–1.10. The vulnerability could allow unauthenticated attackers to bypass security checks through the HTTPS port and potentially execute arbitrary commands.
The issue has been resolved in RutOS 7.24.3 and TswOS 1.10.1. We strongly recommend updating affected devices to these or later versions as soon as possible.
php2shell vulnerability
22/10/26
We are aware of the critical PHP vulnerability chain known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which was partially disclosed on October 20, 2026, with emergency patches released on October 21, 2026. Security patches released by the PHP project were applied to all of our RMS PHP environments as soon as they became available from the maintainers. No evidence of exploitation or compromise has been identified across any of our systems.
2026 RutOS and RMS third-party penetration testing
27/04/26
In collaboration with third-party penetration testing service providers, we have undergone security testing for our RutOS platform based RUTX10 device and Remote Management System. You can learn more about these tests here: RutOS - https://wiki.teltonika-networks.com/view/RUTX10_Device_security
Title
Description
Title and description
- Page 1
NEWS & ARTICLES
Secure Software Development Lifecycle
Ensuring the security of our products and services is a top priority at Teltonika. They are designed, developed, and rigorously tested with security and privacy in mind throughout the software development lifecycle of each release.
In addition to performing vulnerability management, reviewing vulnerability reports, routine monitoring of new vulnerabilities, and handling vulnerability remediation, Teltonika’s core Secure Software Development Lifecycle (SSDL) consists of the following phases:
Training
As a pre-requirement of this lifecycle, Teltonika’s security team drafts training materials and developer test on a yearly basis.
Requirements
Baseline security and privacy requirements for the upcoming release are drafted and communicated internally.
Design
Software design reviews are conducted with the goals of understanding the upcoming release, drafting.
Implementation
Static code scanning tools are maintained and code is reviewed.
Verification
Comprehensive fuzzing, penetration, and final security tests are performed.
Release
Documents are finalised, archived, and taken into account for the following cycle.
