Teltonika RUT950 (RUT950)

Security Grade

Calculator v1

Teltonika RUT950

   Brand: Teltonika

   Category: Router • Model / Gen:  RUT950

   Release Date:  • Status: EOL transition (Support through 2028-07-31)

   Classification Date: 2026-11-01 • Official Website

Security Evaluation

Criterion	Value	Proof	Comment
Known hardware tampering	Very common	🔗 Proof	Unscored: physical reset is documented, but this does not establish the frequency of malicious hardware tampering.
Known vulnerabilities	Very common	🔗 Proof	Multiple historical CVE patches are listed. This rating concerns documented vulnerability history; it does not mean patched firmware remains vulnerable.
Prior attacks	Very common	🔗 Proof	Unscored: model-specific exploitation frequency has not been established. A disclosure or patch list alone is insufficient.
Updatability	Rare	🔗 Proof	RUT9_R_00.07.06.21 (2026-04-15) is listed. Recent updates are sparse and the model is in EOL transition; support has not yet ended. Availability does not prove installation.
Category Score	Score: 3 / 3

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	Certificate-based services are configurable; universal mutual authentication across interfaces is not established.
Communications	No encryption	🔗 Proof	Scope: documented management defaults. HTTP and HTTPS are enabled, but HTTPS redirection defaults off. Plain HTTP remains possible; this is not a claim that all traffic lacks encryption.
Storage	No encryption	🔗 Proof	Unscored: whole-flash encryption has not been established. Encrypted backup export does not demonstrate encryption of resident flash.
Category Score	Score: 3 / 3

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	Separate WebUI users and editable read/write permission groups are documented. SSH users have separate constraints.
Authentication	Basic	🔗 Proof	Password authentication is the baseline. Stronger optional methods require configuration; deployed settings were not tested.
Brute-force protection	Exist	🔗 Proof	IP blocking for failed SSH/WebUI logins defaults on, with a configurable threshold of 10 attempts.
Event logging	Partial logging	🔗 Proof	Login-attempt source, protocol and status are documented. Persistent retention and complete access auditing remain unverified.
Passwords	Require change after setup with complexity requirements	🔗 Proof	First WebUI login requires changing the default password. Minimum eight characters with uppercase, lowercase and a digit are documented.
Category Score	Score: 2 / 3