CVE-2017-20224
Published: 16 March 2026
Description
Telesquare SKT LTE Router SDT-CS3B1 version 1.2.0 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious content by exploiting enabled WebDAV HTTP methods. Attackers can use PUT, DELETE, MKCOL, MOVE, COPY, and PROPPATCH methods to upload…
more
executable code, delete files, or manipulate server content for remote code execution or denial of service.
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations preventing unauthenticated access to WebDAV methods for arbitrary file uploads and manipulations.
Restricts system to least functionality by disabling unnecessary WebDAV HTTP methods, eliminating the exposure.
Monitors and controls communications at boundaries to block unauthorized WebDAV requests leading to file upload or RCE.
Security SummaryAI
CVE-2017-20224 affects the Telesquare SKT LTE Router SDT-CS3B1 version 1.2.0, manifesting as an arbitrary file upload vulnerability. The issue stems from enabled WebDAV HTTP methods, including PUT, DELETE, MKCOL, MOVE, COPY, and PROPPATCH, which permit attackers to upload malicious content without authentication.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction or privileges required, earning it a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation allows uploading executable code for remote code execution, deleting files, or manipulating server content to cause denial of service, linked to CWE-434 (Unrestricted Upload of File with Dangerous Type).
Advisories documenting the vulnerability are available at https://cxsecurity.com/issue/WLB-2017120301, https://www.vulncheck.com/advisories/telesquare-skt-lte-router-sdt-cs3b1-webdav-arbitrary-file-upload, and https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5446.php (ZSL-2017-5446).
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated arbitrary file upload via exposed WebDAV on a public-facing router web interface, directly enabling exploitation of a public-facing application for RCE and full compromise.