PT-2025-23147 · Teltonika Networks · Teltonika Networks Rms

Published 2025-05-29 · Updated 2025-05-30 · CVE-2025-4687

Positive Technologies (AI Summary)

CVSS v4.0

7.2

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Teltonika Networks Remote Management System (RMS) versions prior to 5.7

Description The issue allows for account pre-hijacking by misusing the invite functionality. If a victim has a pending invite and registers to the platform directly, they are added to the attacker's company without their knowledge. The victim's account and their company can then be managed by the attacker.

Recommendations For versions prior to 5.7, update to version 5.7 or later to resolve the issue. As a temporary workaround, consider restricting the use of the invite functionality until a patch is available. Avoid registering to the platform directly if you have a pending invite to minimize the risk of exploitation.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-4687

Affected Products

Teltonika Networks Rms

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-4687 · Security Note
• https://t.me/cvenotify/123958 · Telegram Post
• https://t.me/latest_high_impact_cve/2487 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1928029281348731073 · Twitter Post
• https://jowin922.medium.com/cve-2025-4687-pre-account-takeover-through-invite-on-teletonika-rms-website-972335378829 · Note
• https://twitter.com/cybercronai/status/1928428858467852440 · Twitter Post
• https://t.me/cvetracker/24884 · Telegram Post
• https://twitter.com/offseq/status/1928066332613812578 · Twitter Post
• https://twitter.com/CVEnew/status/1928017789039591608 · Twitter Post