CVE-2017-20224
Published: 16 March 2026
Summary
CVE-2017-20224 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Telesquare Sdt-Cs3B1 Firmware. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 40.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and CM-7 (Least Functionality).
Deeper analysis
CVE-2017-20224 affects the Telesquare SKT LTE Router SDT-CS3B1 version 1.2.0, manifesting as an arbitrary file upload vulnerability. The issue stems from enabled WebDAV HTTP methods, including PUT, DELETE, MKCOL, MOVE, COPY, and PROPPATCH, which permit attackers to upload malicious content without authentication.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction or privileges required, earning it a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation allows uploading executable code for remote code execution, deleting files, or manipulating server content to cause denial of service, linked to CWE-434 (Unrestricted Upload of File with Dangerous Type).
Advisories documenting the vulnerability are available at https://cxsecurity.com/issue/WLB-2017120301, https://www.vulncheck.com/advisories/telesquare-skt-lte-router-sdt-cs3b1-webdav-arbitrary-file-upload, and https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5446.php (ZSL-2017-5446).
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2017-18941
Vulnerability details
Telesquare SKT LTE Router SDT-CS3B1 version 1.2.0 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious content by exploiting enabled WebDAV HTTP methods. Attackers can use PUT, DELETE, MKCOL, MOVE, COPY, and PROPPATCH methods to upload…
more
executable code, delete files, or manipulate server content for remote code execution or denial of service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated arbitrary file upload via exposed WebDAV on a public-facing router web interface, directly enabling exploitation of a public-facing application for RCE and full compromise.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations preventing unauthenticated access to WebDAV methods for arbitrary file uploads and manipulations.
Restricts system to least functionality by disabling unnecessary WebDAV HTTP methods, eliminating the exposure.
Monitors and controls communications at boundaries to block unauthorized WebDAV requests leading to file upload or RCE.