Triple Threat: Breaking Teltonika Routers Three Ways

Comprehensive research by Claroty Team82 and OTORIO discovered eight critical vulnerabilities in Teltonika Networks’ RMS and RUT industrial routers—ranging from unauthenticated device claiming and weak SN/MAC-based certificate issuance to tcpdump command-injection RCE, stored XSS for account takeover, and VPN-based SSRF into internal cloud services—enabling remote device takeover, cloud account compromise, and access to internal infrastructure across thousands of internet-exposed devices; fixes were coordinated with Teltonika and CISA.