PT-2023-20350 · Teltonika · Teltonika'S Remote Management System

Noam Moshe + 2 · Published 2023-05-22 · Updated 2023-05-31 · CVE-2023-2586

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Teltonika’s Remote Management System version 4.14.0

Description The issue allows an unauthorized attacker to register previously unregistered devices through the RMS platform. If the RMS management feature is enabled, an attacker could register a device to themselves, enabling them to perform different operations on the user's devices. This includes remote code execution with root privileges using the Task Manager feature on RMS.

Recommendations For Teltonika’s Remote Management System version 4.14.0, disable the RMS management feature to prevent unauthorized device registration. As a temporary workaround, consider restricting access to the Task Manager feature on RMS until a patch is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-2586

Affected Products

Teltonika'S Remote Management System

References · 5

• https://osv.dev/vulnerability/CVE-2023-2586 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2586 · Security Note
• https://t.me/cvenotify/51513 · Telegram Post
• https://t.me/cibsecurity/64551 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-131-08 · Note