CVE-2025-26009
Published: 26 March 2025
Summary
CVE-2025-26009 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Telesquare Tlr-2005Ksh Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique System Information Discovery (T1082); ranked in the top 38.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AU-13 (Monitoring for Information Disclosure).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the flaw in systemutilit.cgi that improperly exposes sensitive system information to unauthenticated remote attackers.
Enforces approved authorizations preventing unauthenticated remote access to the vulnerable systemutilit.cgi endpoint and its sensitive information.
Monitors the system specifically for unauthorized disclosure of sensitive information via endpoints like systemutilit.cgi.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The unauthenticated remote information disclosure via systemutilit.cgi directly enables retrieval of sensitive system details, mapping to System Information Discovery.
NVD Description
Telesquare TLR-2005KSH 1.1.4 has an Information Disclosure vulnerability when requesting systemutilit.cgi.
Deeper analysisAI
CVE-2025-26009, published on 2025-03-26, is an Information Disclosure vulnerability classified under CWE-200, affecting the Telesquare TLR-2005KSH router in version 1.1.4. The flaw occurs when requesting the systemutilit.cgi component, which improperly exposes sensitive information. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high severity due to significant confidentiality impact.
The vulnerability can be exploited by unauthenticated remote attackers over the network with low attack complexity and no user interaction required. Successful exploitation allows attackers to obtain sensitive system information disclosed by the CGI endpoint, potentially aiding further attacks without impacting integrity or availability.
Advisories and further details are available in the referenced GitHub document at https://github.com/Fan-24/Digging/blob/main/11/1.md.
Details
- CWE(s)