Cyber Posture

CVE-2025-26006

Critical

Published: 26 March 2025

Published
26 March 2025
Modified
01 April 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0041 61.6th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-26006 is an unauthorized stack overflow vulnerability in Telesquare TLR-2005KSH version 1.1.4. The flaw is triggered when processing requests to the admin.cgi parameter with the setAutorest option, classified under CWE-120. Published on 2025-03-26, it carries a CVSS v3.1 base score of 9.8, reflecting its critical severity due to network accessibility, low attack complexity, and no requirements for privileges or user interaction.

Remote attackers can exploit this vulnerability over the network without authentication by sending a specially crafted request to the affected admin.cgi endpoint. Successful exploitation could result in high impacts on confidentiality, integrity, and availability, potentially allowing arbitrary code execution, data disclosure, or denial of service through stack overflow corruption.

Mitigation details are available in the referenced advisory at https://github.com/Fan-24/Digging/blob/main/4/1.md. No specific patches or vendor updates are detailed in the CVE publication.

Details

CWE(s)
CWE-120

Affected Products

telesquare
tlr-2005ksh firmware
1.1.4

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The CVE describes a remote unauthenticated stack overflow in a public-facing admin.cgi web endpoint on a network device, directly enabling exploitation of public-facing applications for remote code execution or denial of service.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References