CVE-2025-26005
Published: 26 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-26005 is an unauthorized stack overflow vulnerability (CWE-120) in Telesquare TLR-2005KSH version 1.1.4. The issue occurs when requesting the admin.cgi parameter with setNtp, allowing exploitation without authentication. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for severe impacts.
Unauthenticated attackers with network access can exploit this vulnerability remotely with low attack complexity and no user interaction required. Successful exploitation enables high confidentiality, integrity, and availability impacts, potentially leading to arbitrary code execution, data theft, system modification, or denial of service on the affected device.
Additional technical details, including potential proof-of-concept information, are documented in the referenced advisory at https://github.com/Fan-24/Digging/blob/main/7/1.md. No specific patch or mitigation guidance is outlined in the available CVE information.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Unauthenticated remote stack overflow in public-facing admin.cgi web interface directly enables T1190 for initial access and arbitrary code execution.