Cyber Resilience

CVE-2023-32349

Teltonika-Networks Rut200 Firmware ≤ 00.07.03.4

Published
22 May 2023
Modified
21 November 2024
CVSS Score v3.1 8.0
Click a component to see what it means
Raw vectorCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0098 59th percentile
Risk Priority 60 floored blend · peak EPSS

Summary

CVE-2023-32349 is a high-severity External Control of System or Configuration Setting (CWE-15) vulnerability in Teltonika-Networks Rut200 Firmware. Its CVSS base score is 8.0 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by PATH Environment Variable (T1574.007); ranked in the top 41% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper validation for filter parameters. However, variables for validation checks are stored in an external configuration file. An authenticated attacker could use an exposed…

more

UCI configuration utility to change these variables and enable malicious parameters in the dump utility, which could result in arbitrary code execution.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1574.007 Path Interception by PATH Environment Variable Stealth
Adversaries may execute their own malicious payloads by hijacking environment variables used to load libraries.
T1547.004 Winlogon Helper DLL Persistence
Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in.
T1547.014 Active Setup Persistence
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
T1574 Hijack Execution Flow Stealth
Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs.
T1574.006 Dynamic Linker Hijacking Stealth
Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries.
T1574.012 COR_PROFILER Stealth
Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-32350Same product: Teltonika-Networks Rut200
CVE-2023-3321Shared CWE-15
CVE-2025-43792Shared CWE-15
CVE-2026-41384Shared CWE-15
CVE-2024-51544Shared CWE-15
CVE-2025-62527Shared CWE-15
CVE-2024-39789Shared CWE-15
CVE-2024-39793Shared CWE-15
CVE-2026-33092Shared CWE-15
CVE-2024-39788Shared CWE-15

Affected Assets

teltonika-networks
rut200 firmware
≤ 00.07.03.4
teltonika-networks
rut240 firmware
≤ 00.07.03.4
teltonika-networks
rut241 firmware
≤ 00.07.03.4
teltonika-networks
rut300 firmware
≤ 00.07.03.4
teltonika-networks
rut360 firmware
≤ 00.07.03.4
teltonika-networks
rut901 firmware
≤ 00.07.03.4
teltonika-networks
rut950 firmware
≤ 00.07.03.4
teltonika-networks
rut951 firmware
≤ 00.07.03.4
teltonika-networks
rut955 firmware
≤ 00.07.03.4
teltonika-networks
rut956 firmware
≤ 00.07.03.4
+8 more product configuration(s) — see NVD for full list

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 4 hardening rules · 2 OS baselines
Validate
Prove the fix (OWASP ASVS)

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-15

The policy and procedures establish internal controls and change management for system configuration settings, reducing the feasibility of external unauthorized modifications.

addresses: CWE-15

Baseline configuration under change control directly prevents unauthorized external modification of system or configuration settings.

addresses: CWE-15

Requires approval, documentation, and security impact review of all configuration changes, directly preventing unauthorized external control of system settings.

addresses: CWE-15

Impact analysis of configuration changes reduces the risk of deploying settings that permit unauthorized external control.

addresses: CWE-15

Restricting changes to system and configuration settings prevents external entities from controlling those settings without approval.

addresses: CWE-15

Establishing, implementing, approving deviations from, and monitoring configuration settings directly prevents external or unauthorized control of system settings.

addresses: CWE-15

The plan defines processes for identifying and managing configuration items, preventing external unauthorized control of system settings.

addresses: CWE-15

Vulnerability scanners directly detect externally controllable or misconfigured settings using standardized checklists.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-01 mostly match
prevents

Hardened configuration baselines and change controls directly limit external manipulation of settings.

ID.RA-07 partial match
prevents

Formal change and exception management catches externally driven configuration alterations.

PR.AA-05 partial match
prevents

Least-privilege access policies reduce unauthorized external modification of configuration values.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

degrades

Configuration management directly prevents external tampering with system settings.

prevents

Access rights assignment determines who may change system settings.

prevents

Privileged access rights reduce the number of users who can alter configuration.

prevents

Information access restriction limits who can view or modify configuration data.

prevents

Change management enforces controlled, authorized modifications to settings.

prevents

Access control policies underpin the technical restrictions on configuration changes.

References