Teltonika RUTM30 (RUTM30)

Documentation-based security assessment — pending evidence completion and administrator review. No overall grade is assigned.

Device

• Product: Teltonika RUTM30
• Brand: Teltonika
• Model: RUTM30
• Type: Router
• Operating system: RutOS
• Website: Official model documentation
• Exact commercial release date: unverified

Device security

Criterion	Assessment	Evidence	Comment
Known hardware tampering	Unscored — insufficient evidence	Source	Unscored: physical reset is documented, but this does not establish the frequency of malicious hardware tampering.
Known vulnerabilities	Very common	Source	Multiple historical CVE patches are listed. This rating concerns documented vulnerability history; it does not mean patched firmware remains vulnerable.
Prior attacks	Unscored — insufficient evidence	Source	Unscored: model-specific exploitation frequency has not been established. A disclosure or patch list alone is insufficient.
Updatability	Very common	Source	RUTM_R_00.07.26 (2026-10-16) is listed. Multiple releases and security updates are documented. Availability does not prove installation.

System security

Criterion	Assessment	Evidence	Comment
Authentication with other systems	Partial	Source	Certificate-based services are configurable; universal mutual authentication across interfaces is not established.
Communications	Encrypted with up-to-date encryption	Source	Scope: documented management defaults. HTTPS and HTTP-to-HTTPS redirection default on; remote WebUI access defaults off. Optional plaintext services may still exist.
Storage encryption	Unscored — insufficient evidence	Source	Unscored: whole-flash encryption has not been established. Encrypted backup export does not demonstrate encryption of resident flash.

User authentication

Criterion	Assessment	Evidence	Comment
Account management	Full	Source	Separate WebUI users and editable read/write permission groups are documented. SSH users have separate constraints.
Authentication	Basic	Source	Password authentication is the baseline. Stronger optional methods require configuration; deployed settings were not tested.
Brute-force protection	Exist	Source	IP blocking for failed SSH/WebUI logins defaults on, with a configurable threshold of 10 attempts.
Event logging	Partial logging	Source	Login-attempt source, protocol and status are documented. Persistent retention and complete access auditing remain unverified.
Passwords	Require change after setup with complexity requirements	Source	First WebUI login requires changing the default password. Minimum eight characters with uppercase, lowercase and a digit are documented. A special character is also required.

Scope and evidence gaps

Documentation review dated 2026-10-24; no hands-on testing. Criteria describe the cited model manuals and firmware histories, not every installed configuration. Unknown values are intentionally unscored and require administrator review. The exact commercial release date has not been verified and is left blank.

Hardware-tampering frequency, flash encryption and real-world attack frequency are not established by the reviewed evidence. The assessment deliberately omits an overall score until those gaps are resolved.