CVE-2025-9603
📋 TL;DR
This CVE describes a command injection vulnerability in Telesquare TLR-2005KSH routers version 1.2.4. Attackers can execute arbitrary commands by manipulating the Hostname parameter in the /cgi-bin/internet.cgi endpoint. Organizations using these routers with internet-facing administration interfaces are at risk.
💻 Affected Systems
- Telesquare TLR-2005KSH
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands, install malware, pivot to internal networks, or disrupt network services.
Likely Case
Unauthorized command execution leading to network disruption, data exfiltration, or use as a foothold for further attacks.
If Mitigated
Limited impact if proper network segmentation and access controls prevent exploitation attempts.
🎯 Exploit Status
Public proof-of-concept exists, and the vulnerability requires no authentication to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch is available. Consider workarounds or replacement.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict access to the router's administration interface to trusted IP addresses only.
Disable Remote Administration
allDisable remote administration features if not required.
🧯 If You Can't Patch
- Segment affected routers in isolated network zones with strict firewall rules.
- Implement network monitoring and intrusion detection for suspicious traffic to router management interfaces.
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface or CLI. If version is 1.2.4, the device is vulnerable.Check Version:
Check via router web interface or consult device documentation for CLI commands.Verify Fix Applied:
No official fix available to verify.📡 Detection & Monitoring
Log Indicators:
- Unusual commands in system logs
- Failed authentication attempts to /cgi-bin/internet.cgi
Network Indicators:
- Suspicious HTTP POST requests to /cgi-bin/internet.cgi with command injection patterns
SIEM Query:
Search for HTTP requests containing 'internet.cgi?Command=lanCfg' with unusual Hostname parameter values.🔗 References
- https://github.com/lin-3-start/lin-cve/blob/main/Telesquare%20Tlr-2005Ksh/Telesquare%20Tlr-2005Ksh%E5%AD%98%E5%9C%A8%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
- https://github.com/lin-3-start/lin-cve/blob/main/Telesquare%20Tlr-2005Ksh/Telesquare%20Tlr-2005Ksh%E5%AD%98%E5%9C%A8%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md#3poc
- https://vuldb.com/?ctiid.321779
- https://vuldb.com/?id.321779
- https://vuldb.com/?submit.636414
- https://github.com/lin-3-start/lin-cve/blob/main/Telesquare%20Tlr-2005Ksh/Telesquare%20Tlr-2005Ksh%E5%AD%98%E5%9C%A8%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
- https://github.com/lin-3-start/lin-cve/blob/main/Telesquare%20Tlr-2005Ksh/Telesquare%20Tlr-2005Ksh%E5%AD%98%E5%9C%A8%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md#3poc
