Login Sign Up

CVE-2021-46424

9.1 CRITICAL
Denial of Service

📋 TL;DR

CVE-2021-46424 is an arbitrary file deletion vulnerability in Telesquare TLR-2005KSH routers that allows remote attackers to delete any file on the system, including critical system files, via a crafted DELETE request. This affects Telesquare TLR-2005KSH version 1.0.0. Organizations using these routers are vulnerable to complete system compromise.

💻 Affected Systems

Products:
  • Telesquare TLR-2005KSH
Versions: 1.0.0
Operating Systems: Embedded router OS
Default Config Vulnerable: ⚠️ Yes
Notes: All default installations of version 1.0.0 are vulnerable. No special configuration required.

📦 What is this software?

Tlr 2005ksh Firmware by Telesquare

View all CVEs affecting Tlr 2005ksh Firmware →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise leading to device bricking, data destruction, and potential lateral movement to connected networks.

🟠

Likely Case

Service disruption, data loss, and potential privilege escalation by deleting critical system files.

🟢

If Mitigated

Limited impact if device is behind strict network controls and file deletion attempts are blocked.

🌐 Internet-Facing: HIGH - Remote exploitation via DELETE requests makes internet-facing devices extremely vulnerable.
🏢 Internal Only: HIGH - Even internally, the vulnerability allows complete file system access without authentication.

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Simple HTTP DELETE request with file path parameter. Public exploit code available in references.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Unknown

Vendor Advisory: None found

Restart Required: No

Instructions:

No official patch available. Consider replacing affected devices or implementing strict network controls.

🔧 Temporary Workarounds

Network Access Control

linux

Block all HTTP DELETE requests to affected devices at network perimeter.

iptables -A INPUT -p tcp --dport 80 -m string --string "DELETE" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 443 -m string --string "DELETE" --algo bm -j DROP

Web Application Firewall Rules

all

Configure WAF to block DELETE requests containing file paths.

🧯 If You Can't Patch

  • Isolate affected devices in separate VLAN with strict access controls
  • Implement network monitoring for DELETE requests to device IPs

🔍 How to Verify

Check if Vulnerable:

Send HTTP DELETE request to device with file path parameter and check response. Use curl: curl -X DELETE http://device-ip/path/to/testfile

Check Version:

Check web interface or use nmap: nmap -sV -p 80,443 device-ip

Verify Fix Applied:

Test same DELETE request after implementing controls - should be blocked or return error.

📡 Detection & Monitoring

Log Indicators:

  • HTTP DELETE requests in web server logs
  • File deletion events in system logs

Network Indicators:

  • HTTP DELETE packets to router IP on port 80/443
  • Unusual file system access patterns

SIEM Query:

source="router-logs" method="DELETE" OR "file deletion" OR "unlink"

📊 Metadata

CVE ID: CVE-2021-46424
CVSS v3 Score: 9.1 (CRITICAL)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Published: April 27, 2022
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON