CVE-2025-26005
Published: 26 March 2025
Summary
CVE-2025-26005 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Telesquare Tlr-2005Ksh Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces validation of the setNtp parameter in admin.cgi to prevent stack buffer overflows from malformed or oversized inputs.
Implements memory protections like stack canaries, ASLR, and non-executable memory to block exploitation of the stack overflow for arbitrary code execution.
Mandates timely scanning, prioritization, and remediation of the specific stack overflow flaw in Telesquare TLR-2005KSH version 1.1.4.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote stack overflow in public-facing admin.cgi web interface directly enables T1190 for initial access and arbitrary code execution.
NVD Description
Telesquare TLR-2005KSH 1.1.4 is vulnerable to unauthorized stack overflow vulnerability when requesting admin.cgi parameter with setNtp.
Deeper analysisAI
CVE-2025-26005 is an unauthorized stack overflow vulnerability (CWE-120) in Telesquare TLR-2005KSH version 1.1.4. The issue occurs when requesting the admin.cgi parameter with setNtp, allowing exploitation without authentication. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for severe impacts.
Unauthenticated attackers with network access can exploit this vulnerability remotely with low attack complexity and no user interaction required. Successful exploitation enables high confidentiality, integrity, and availability impacts, potentially leading to arbitrary code execution, data theft, system modification, or denial of service on the affected device.
Additional technical details, including potential proof-of-concept information, are documented in the referenced advisory at https://github.com/Fan-24/Digging/blob/main/7/1.md. No specific patch or mitigation guidance is outlined in the available CVE information.
Details
- CWE(s)