CVE-2025-26010
Published: 26 March 2025
Summary
CVE-2025-26010 is a critical-severity Improper Access Control (CWE-284) vulnerability in Telesquare Tlr-2005Ksh Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 43.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-2 (Account Management).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for access to sensitive functions like setUserNamePassword in admin.cgi, directly preventing unauthorized password modifications.
Limits and authorizes specific actions performable without identification or authentication, prohibiting unauthenticated password changes.
Establishes managed processes for account and authenticator changes, requiring approvals to block unauthorized administrative password modifications.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remote unauthenticated exploit in the router's public-facing web admin interface (admin.cgi/setUserNamePassword) that bypasses access controls to modify passwords and gain full device control, directly mapping to exploitation of public-facing applications for initial access.
NVD Description
Telesquare TLR-2005KSH 1.1.4 allows unauthorized password modification when requesting the admin.cgi parameter with setUserNamePassword.
Deeper analysisAI
CVE-2025-26010 affects the Telesquare TLR-2005KSH router running version 1.1.4. The vulnerability enables unauthorized password modification through a request to the admin.cgi parameter using the setUserNamePassword function, bypassing proper access controls. Classified under CWE-284 (Improper Access Control), it received a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) upon publication on 2025-03-26.
The flaw is exploitable by unauthenticated remote attackers with network access, requiring low complexity and no user interaction. Exploitation allows modification of administrative passwords, resulting in high-impact compromise of confidentiality, integrity, and availability, potentially granting full control over the affected device.
Mitigation details are available in the referenced advisory at https://github.com/Fan-24/Digging/blob/main/9/1.md.
Details
- CWE(s)