CVE-2025-26006
Published: 26 March 2025
Summary
CVE-2025-26006 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Telesquare Tlr-2005Ksh Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation of the stack overflow flaw in admin.cgi through patching or compensatory controls to eliminate the vulnerability.
Mandates validation of inputs to the setAutorest parameter in admin.cgi to prevent buffer overflows from specially crafted requests.
Deploys memory protections such as stack canaries and non-executable memory to mitigate arbitrary code execution from stack overflows in admin.cgi.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remote unauthenticated stack overflow in a public-facing admin.cgi web endpoint on a network device, directly enabling exploitation of public-facing applications for remote code execution or denial of service.
NVD Description
Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setAutorest.
Deeper analysisAI
CVE-2025-26006 is an unauthorized stack overflow vulnerability in Telesquare TLR-2005KSH version 1.1.4. The flaw is triggered when processing requests to the admin.cgi parameter with the setAutorest option, classified under CWE-120. Published on 2025-03-26, it carries a CVSS v3.1 base score of 9.8, reflecting its critical severity due to network accessibility, low attack complexity, and no requirements for privileges or user interaction.
Remote attackers can exploit this vulnerability over the network without authentication by sending a specially crafted request to the affected admin.cgi endpoint. Successful exploitation could result in high impacts on confidentiality, integrity, and availability, potentially allowing arbitrary code execution, data disclosure, or denial of service through stack overflow corruption.
Mitigation details are available in the referenced advisory at https://github.com/Fan-24/Digging/blob/main/4/1.md. No specific patches or vendor updates are detailed in the CVE publication.
Details
- CWE(s)