CVE-2021-45428
📋 TL;DR
This vulnerability allows unauthenticated attackers to upload arbitrary files (including HTML and CGI scripts) to the TLR-2005KSH device via the enabled PUT method. This affects all users of the vulnerable TLR-2005KSH device with default configurations.
💻 Affected Systems
- TLR-2005KSH
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution, data theft, device takeover, and lateral movement within the network.
Likely Case
Malicious file upload leading to web shell installation, data exfiltration, or denial of service.
If Mitigated
Unauthorized file upload attempts are blocked, preventing exploitation while maintaining device functionality.
🎯 Exploit Status
Simple HTTP PUT requests can exploit this vulnerability without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Apply workarounds or replace device.
🔧 Temporary Workarounds
Disable PUT method
allConfigure web server to disable HTTP PUT method
# Configuration depends on web server implementation
# Check device documentation for HTTP method configuration
Network segmentation
linuxIsolate device in separate VLAN with strict firewall rules
# Example firewall rule to block external access:
iptables -A INPUT -p tcp --dport 80 -s ! 192.168.1.0/24 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit device exposure
- Deploy web application firewall to block malicious file upload attempts
🔍 How to Verify
Check if Vulnerable:
Test if HTTP PUT method is accepted: curl -X PUT http://device-ip/ -d 'test'Check Version:
# Check device firmware version via web interface or serial consoleVerify Fix Applied:
Verify PUT method returns 405 Method Not Allowed or is blocked📡 Detection & Monitoring
Log Indicators:
- HTTP PUT requests to device
- File upload attempts to unusual paths
- CGI script execution
Network Indicators:
- HTTP PUT traffic to device port 80/443
- Unexpected file uploads
SIEM Query:
source="device_logs" AND (method="PUT" OR uri CONTAINS ".cgi" OR uri CONTAINS ".html")🔗 References
- http://packetstormsecurity.com/files/167101/TLR-2005KSH-Arbitrary-File-Upload.html
- https://drive.google.com/file/d/1wM1SPOfB9mH2SES7cAmlysuI9fOpFB3F/view?usp=sharing
- http://packetstormsecurity.com/files/167101/TLR-2005KSH-Arbitrary-File-Upload.html
- https://drive.google.com/file/d/1wM1SPOfB9mH2SES7cAmlysuI9fOpFB3F/view?usp=sharing
