CVE-2025-26004
Published: 26 March 2025
Summary
CVE-2025-26004 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Telesquare Tlr-2005Ksh Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-16 directly mitigates stack buffer overflow exploits through memory protections like stack canaries, ASLR, and DEP tailored to this CWE-120 vulnerability.
SI-10 enforces input validation on the setDdns parameter in admin.cgi requests to prevent buffer overflow conditions.
AC-3 enforces authentication and authorization before processing admin.cgi requests, blocking unauthorized remote access to the vulnerable endpoint.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remote unauthenticated stack buffer overflow in a public-facing admin.cgi interface on a network device, directly enabling exploitation of public-facing applications for initial access and arbitrary code execution.
NVD Description
Telesquare TLR-2005KSH 1.1.4 is vulnerable to unauthorized stack buffer overflow vulnerability when requesting admin.cgi parameter with setDdns.
Deeper analysisAI
CVE-2025-26004 is an unauthorized stack buffer overflow vulnerability (CWE-120) in Telesquare TLR-2005KSH version 1.1.4. The flaw is triggered when processing requests to the admin.cgi parameter with the setDdns argument, allowing buffer overflow conditions without authentication.
The vulnerability has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable remotely over the network by unauthenticated attackers with low complexity and no user interaction. Attackers can achieve high impacts across confidentiality, integrity, and availability, potentially leading to arbitrary code execution, data compromise, or device takeover.
Further technical details, including potential exploitation vectors, are documented in the advisory at https://github.com/Fan-24/Digging/blob/main/6/1.md. No specific patches or mitigations are detailed in available sources.
Details
- CWE(s)