CVE-2025-26002
📋 TL;DR
This vulnerability allows unauthenticated remote attackers to execute arbitrary code on Telesquare TLR-2005KSH routers by exploiting a buffer overflow in the admin.cgi endpoint. Attackers can gain full control of affected devices, potentially compromising network security. Only Telesquare TLR-2005KSH routers running version 1.1.4 are affected.
💻 Affected Systems
- Telesquare TLR-2005KSH
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover leading to network pivoting, data exfiltration, and persistent backdoor installation across the network.
Likely Case
Remote code execution allowing attackers to modify configurations, intercept traffic, or use the device as a foothold for further attacks.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Public GitHub repositories contain proof-of-concept code demonstrating exploitation. The vulnerability requires no authentication and has a simple exploitation path.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
No official patch is currently available. Monitor Telesquare's security advisories for updates.
🔧 Temporary Workarounds
Block admin.cgi Access
linuxUse firewall rules to block access to the vulnerable admin.cgi endpoint
iptables -A INPUT -p tcp --dport 80 -m string --string "admin.cgi" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 443 -m string --string "admin.cgi" --algo bm -j DROP
Disable Web Interface
allDisable the router's web management interface if not required
🧯 If You Can't Patch
- Isolate affected routers in a dedicated VLAN with strict network segmentation
- Implement strict firewall rules to only allow necessary traffic to/from the devices
🔍 How to Verify
Check if Vulnerable:
Check if the router responds to requests to /admin.cgi with setSyncTimeHost parameter containing overly long inputCheck Version:
Check web interface or use SNMP to query system version informationVerify Fix Applied:
Test if the buffer overflow condition still exists by attempting to trigger the vulnerability with safe testing methods📡 Detection & Monitoring
Log Indicators:
- Multiple failed or successful requests to admin.cgi with long parameter values
- Unusual process execution or system modifications
Network Indicators:
- HTTP requests containing 'admin.cgi' with 'setSyncTimeHost' parameter exceeding normal length
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND (uri="*admin.cgi*" AND param="*setSyncTimeHost*") | stats count by src_ip