Teltonika RUT300 (RUT300)

Assessment status: incomplete evidence review. Flash encryption and real-world attack frequency remain unscored. Any automatically displayed grade is not a validated overall security conclusion.

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	Physical reset and Ethernet bootloader recovery are documented. Rare is a qualitative physical-exposure rating, not measured attack prevalence.
Known vulnerabilities	Very common	🔗 Proof	The model firmware history records multiple CVE fixes. This describes historical exposure; it does not claim patched versions remain vulnerable.
Prior attacks		🔗 Proof	Unscored: model-specific real-world attack frequency has not been established. Vulnerability disclosures alone do not demonstrate exploitation.
Updatability	Rare	🔗 Proof	Latest listed firmware is 7.14.5 dated 2026-04-15; recent releases are sparse. The product is in the vendor EOL catalogue, not necessarily already unsupported.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	Certificates and authenticated services are configurable; universal mutual authentication across all interfaces is not established.
Communications	No encryption	🔗 Proof	Conservative baseline: local HTTP is enabled and HTTPS redirection defaults off in this model manual. HTTPS is also available; not all communications are plaintext.
Storage		🔗 Proof	Unscored: backup encryption documentation does not establish encryption of data stored in flash. Do not infer whole-flash encryption from encrypted exports.
Category Score	Score: / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	Separate WebUI users, editable permission groups, password changes and lower-privilege access are documented. SSH accounts have separate constraints.
Authentication	Basic	🔗 Proof	Password login is the baseline. Optional stronger methods must be configured; recovery-mode security and installed firmware were not tested.
Brute-force protection	Exist	🔗 Proof	The model manual documents IP blocking after failed SSH/WebUI logins, enabled by default with a configurable threshold of 10.
Event logging	Partial logging	🔗 Proof	Failed-login source, protocol and attempt status are available. Persistent audit completeness and log retention have not been verified.
Passwords	Require change after setup with complexity requirements	🔗 Proof	Initial setup requires a new password; complexity requirements are documented. Defaults vary across firmware and hardware batches.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	RutOS (Companion App: )
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity:
Physical (Dimensions & Mass)	Dimensions: • Mass:

Scope and evidence gaps

Documentation review dated 2026-10-24; no hands-on testing. Ratings describe documented features and explicitly identified assumptions, not every deployed configuration. Two unknown criteria are intentionally left unscored rather than equated with safety or lack of encryption. Administrator review is requested before treating the calculated grade as final.

Release date uses the manufacturer introduction announcement: manufacturer announcement.

See the vendor lifecycle table for support milestones.