On 30 October 2026, Teltonika Networks reported a critical vulnerability, CVE-2026-82104. An attacker can use a specially crafted HTTPS request to bypass security checks and potentially execute arbitrary commands on the device without logging in.
1. Check your '>firmware version
Sign in to the device’s web interface (WebUI) and open System → '>Firmware → Update '>Firmware to see the installed version. Check each device separately, as devices of the same model can run different versions.
| '>Firmware | Affected versions | First fixed version |
|---|---|---|
| RutOS | 7.22 through 7.24.2 | 7.24.3 |
| TswOS | 1.9 through 1.10 | 1.10.1 |
If your version is affected, update as soon as possible. Prioritise devices whose web interface is directly accessible from the internet. Teltonika Networks security advisory
2. Update the '>firmware and verify the result
Menu labels may vary by model and '>firmware version. Manufacturer’s RutOS and TswOS update guide
3. If you cannot update immediately, restrict management access
Block direct internet access to the web interface. In RutOS, look for Enable remote HTTPS access under System → Administration → Access Control. If it is enabled and you do not need direct access from the internet, turn it off. If you manage the device remotely only, first verify that an alternative access route works, such as an existing '>VPN. Otherwise, you may lose access to the device. Remote device access documentation
Restricting access reduces risk temporarily. The '>firmware update fixes the vulnerability. Changing the password alone does not address it because the attack does not require authentication.
Need help with the update?
Email SECTRON technical support at hotline@sectron.cz. Include the exact device model, current '>firmware version and whether you can access the device locally or manage it remotely.
