CVE-2025-26007
Published: 26 March 2025
Summary
CVE-2025-26007 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Telesquare Tlr-2005Ksh Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 28.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-26007 is an unauthorized stack overflow vulnerability (CWE-120) affecting Telesquare TLR-2005KSH version 1.1.4. The issue resides in the login interface, triggered when requesting the systemtil.cgi endpoint. Published on 2025-03-26, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for complete system compromise.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction required. By sending a specially crafted request to systemtil.cgi, the attacker triggers a stack overflow, enabling high-impact consequences including unauthorized access to sensitive data (C:H), modification of system integrity (I:H), and denial of service or code execution (A:H).
For mitigation details, refer to the advisory at https://github.com/Fan-24/Digging/blob/main/10/1.md.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8243
Vulnerability details
Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability in the login interface when requesting systemtil.cgi.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remote unauthenticated stack overflow in the public-facing login interface (systemtil.cgi) of a network device, directly enabling exploitation of a public-facing application for code execution and full system compromise.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the stack overflow vulnerability in systemtil.cgi by applying firmware patches or updates to Telesquare TLR-2005KSH version 1.1.4.
Enforces validation of inputs to the login interface's systemtil.cgi endpoint to prevent specially crafted requests from triggering the stack overflow.
Implements memory protections such as stack canaries and non-executable stacks to mitigate exploitation of the stack overflow vulnerability even if invalid inputs are processed.