Cyber Posture

CVE-2025-26005

Critical

Published: 26 March 2025

Published
26 March 2025
Modified
01 April 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0041 61.6th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-26005 is an unauthorized stack overflow vulnerability (CWE-120) in Telesquare TLR-2005KSH version 1.1.4. The issue occurs when requesting the admin.cgi parameter with setNtp, allowing exploitation without authentication. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for severe impacts.

Unauthenticated attackers with network access can exploit this vulnerability remotely with low attack complexity and no user interaction required. Successful exploitation enables high confidentiality, integrity, and availability impacts, potentially leading to arbitrary code execution, data theft, system modification, or denial of service on the affected device.

Additional technical details, including potential proof-of-concept information, are documented in the referenced advisory at https://github.com/Fan-24/Digging/blob/main/7/1.md. No specific patch or mitigation guidance is outlined in the available CVE information.

Details

CWE(s)
CWE-120

Affected Products

telesquare
tlr-2005ksh firmware
1.1.4

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Unauthenticated remote stack overflow in public-facing admin.cgi web interface directly enables T1190 for initial access and arbitrary code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References