CVE-2025-26011
Published: 26 March 2025
Summary
CVE-2025-26011 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Telesquare Tlr-2005Ksh Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of inputs to the setUsernamePassword parameter in admin.cgi, directly preventing the stack overflow vulnerability.
Mandates timely patching or remediation of the specific buffer overflow flaw in Telesquare TLR-2005KSH firmware version 1.1.4.
Implements memory protections like stack canaries and non-executable memory to mitigate exploitation of the stack overflow for code execution or DoS.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated stack buffer overflow in public-facing admin.cgi web interface directly enables T1190 Exploit Public-Facing Application for RCE/DoS on the network device.
NVD Description
Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setUsernamePassword.
Deeper analysisAI
CVE-2025-26011 is an unauthorized stack overflow vulnerability in the Telesquare TLR-2005KSH router running version 1.1.4. The flaw is triggered when the device processes a request to the admin.cgi parameter using the setUsernamePassword function, leading to a buffer overflow condition classified under CWE-120.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), making it highly severe. Remote, unauthenticated attackers can exploit it over the network with low complexity and no user interaction, potentially achieving high impacts on confidentiality, integrity, and availability through arbitrary code execution or denial of service.
Mitigation details and additional technical analysis are available in the referenced advisory at https://github.com/Fan-24/Digging/blob/main/8/1.md, published on 2025-03-26.
Details
- CWE(s)