CVE-2025-26003
Published: 26 March 2025
Summary
CVE-2025-26003 is a critical-severity Code Injection (CWE-94) vulnerability in Telesquare Tlr-2005Ksh Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 25.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2025-26003 by requiring timely remediation of the command injection flaw in the admin.cgi setAutorest parameter through patches or updates.
Prevents command injection exploitation in CVE-2025-26003 by validating and sanitizing the setAutorest parameter to block malicious command payloads.
Enforces access controls to block unauthorized requests to the vulnerable admin.cgi setAutorest endpoint, reducing unauthenticated command execution risk.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote command injection in public-facing admin.cgi CGI script directly enables T1190 exploitation of public-facing applications for initial access and arbitrary command execution via Unix shell (T1059.004) on the Linux-based device.
NVD Description
Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized command execution vulnerability when requesting the admin.cgi parameter with setAutorest.
Deeper analysisAI
CVE-2025-26003 is an unauthorized command execution vulnerability (CWE-94: Code Injection) affecting Telesquare TLR-2005KSH version 1.1.4. The issue arises when the admin.cgi parameter is requested with the setAutorest option, allowing improper handling that leads to command injection. Published on 2025-03-26, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for complete system compromise.
The vulnerability can be exploited by any unauthenticated attacker with network access to the affected device. Exploitation requires low complexity and no user interaction, enabling remote arbitrary command execution. This grants high-impact privileges, potentially allowing full control over the device, including data exfiltration, modification, or disruption of services.
Mitigation details and further technical analysis are provided in the referenced advisory at https://github.com/Fan-24/Digging/blob/main/5/1.md.
Details
- CWE(s)