CVE-2025-26008
Published: 26 March 2025
Summary
CVE-2025-26008 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Telesquare Tlr-2005Ksh Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces validation of the setSyncTimeHost parameter in admin.cgi to prevent buffer overflow conditions from crafted HTTP requests.
Implements memory protections like stack canaries, ASLR, and DEP to mitigate exploitation of the stack overflow vulnerability.
Remediates the specific stack overflow flaw in Telesquare TLR-2005KSH firmware 1.1.4 via timely patching or code correction.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote stack overflow in public-facing admin.cgi web endpoint on router directly enables T1190 for arbitrary code execution and full compromise.
NVD Description
In Telesquare TLR-2005KSH 1.1.4, an unauthorized stack overflow vulnerability exists when requesting admin.cgi parameter with setSyncTimeHost.
Deeper analysisAI
CVE-2025-26008 is an unauthorized stack overflow vulnerability (CWE-120) in the Telesquare TLR-2005KSH router running firmware version 1.1.4. The issue arises when processing a request to the admin.cgi endpoint with the setSyncTimeHost parameter, allowing buffer overflow conditions without authentication.
A remote attacker requires no privileges, user interaction, or special access, as indicated by the CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). By sending a specially crafted HTTP request to the vulnerable admin.cgi parameter, an unauthenticated attacker over the network can trigger the stack overflow, potentially leading to arbitrary code execution, full system compromise, and high impacts on confidentiality, integrity, and availability.
Mitigation details and additional technical information are available in the referenced advisory at https://github.com/Fan-24/Digging/blob/main/2/1.md.
Details
- CWE(s)