Teltonika RUT906 (RUT906)

Teltonika RUT906 (RUT906)
Security Grade C Calculator v1	Teltonika RUT906 Brand: Teltonika Category: Router • Model / Gen: RUT906 Release Date: • Status: Classification Date: 2026-11-01 • Official Website

Security Evaluation

Criterion	Value	Proof	Comment
Known hardware tampering	Very common	🔗 Proof	Unscored: physical reset is documented, but this does not establish the frequency of malicious hardware tampering.
Known vulnerabilities	Very common	🔗 Proof	Multiple historical CVE patches are listed. This rating concerns documented vulnerability history; it does not mean patched firmware remains vulnerable.
Prior attacks	Very common	🔗 Proof	Unscored: model-specific exploitation frequency has not been established. A disclosure or patch list alone is insufficient.
Updatability	Very common	🔗 Proof	RUT9M_R_00.07.24.3 (2026-08-28) is listed. Multiple releases and security updates are documented. Availability does not prove installation.
Category Score	Score: 3 / 3

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	Certificate-based services are configurable; universal mutual authentication across interfaces is not established.
Communications	Encrypted with up-to-date encryption	🔗 Proof	Scope: documented management defaults. HTTPS and HTTP-to-HTTPS redirection default on; remote WebUI access defaults off. Optional plaintext services may still exist.
Storage	No encryption	🔗 Proof	Unscored: whole-flash encryption has not been established. Encrypted backup export does not demonstrate encryption of resident flash.
Category Score	Score: 2 / 3

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	Separate WebUI users and editable read/write permission groups are documented. SSH users have separate constraints.
Authentication	Basic	🔗 Proof	Password authentication is the baseline. Stronger optional methods require configuration; deployed settings were not tested.
Brute-force protection	Exist	🔗 Proof	IP blocking for failed SSH/WebUI logins defaults on, with a configurable threshold of 10 attempts.
Event logging	Partial logging	🔗 Proof	Login-attempt source, protocol and status are documented. Persistent retention and complete access auditing remain unverified.
Passwords	Require change after setup with complexity requirements	🔗 Proof	First WebUI login requires changing the default password. Minimum eight characters with uppercase, lowercase and a digit are documented. A special character is also required.
Category Score	Score: 2 / 3