CVE-2025-26002
Published: 26 March 2025
Summary
CVE-2025-26002 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Telesquare Tlr-2005Ksh Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 28.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-26002 is an unauthorized stack overflow vulnerability (CWE-120) affecting Telesquare TLR-2005KSH version 1.1.4. The issue arises when processing requests to the admin.cgi parameter with the setSyncTimeHost argument, allowing buffer overflow conditions without authentication. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for complete system compromise.
A remote unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction required. By sending a specially crafted request to the vulnerable admin.cgi endpoint, the attacker triggers the stack overflow, potentially achieving arbitrary code execution with high impacts on confidentiality, integrity, and availability.
Further technical details and analysis are provided in the referenced GitHub repositories, including https://github.com/Fan-24/Digging/blob/main/3/1.md and https://github.com/Fan-24/Digging/tree/main/2. No specific patch or mitigation guidance is detailed in the CVE publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8247
Vulnerability details
Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setSyncTimeHost.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The unauthenticated remote stack overflow in the public-facing admin.cgi endpoint directly enables exploitation of a public-facing application for arbitrary code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the stack overflow vulnerability in admin.cgi's setSyncTimeHost parameter through timely flaw correction or patching.
Prevents buffer overflow exploitation by validating crafted inputs to the setSyncTimeHost parameter for anomalies in length and format.
Implements runtime memory protections like stack canaries and ASLR to block arbitrary code execution from stack overflows.