CVE-2025-9603
Published: 29 August 2025
Summary
CVE-2025-9603 is a medium-severity Injection (CWE-74) vulnerability in Telesquare Tlr-2005Ksh Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked in the top 24.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection via public-facing web CGI (/cgi-bin/internet.cgi?Command=lanCfg) enables exploitation of public-facing applications (T1190), indirect command execution through parameter manipulation (T1202), and command/script interpreter abuse (T1059, likely Unix Shell on the device).
NVD Description
A vulnerability was determined in Telesquare TLR-2005KSH 1.2.4. The affected element is an unknown function of the file /cgi-bin/internet.cgi?Command=lanCfg. Executing manipulation of the argument Hostname can lead to command injection. The attack may be performed from a remote location. The…
more
exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2025-9603 is a command injection vulnerability (CWE-74, CWE-77) affecting Telesquare TLR-2005KSH version 1.2.4. The issue exists in an unknown function of the file /cgi-bin/internet.cgi?Command=lanCfg, where manipulation of the Hostname argument enables command injection. Published on 2025-08-29, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
A remote attacker with low privileges can exploit this vulnerability from a remote location with low complexity and no user interaction required. Successful exploitation allows limited impacts on confidentiality, integrity, and availability through arbitrary command execution.
Advisories from VulDB and related references indicate no vendor response or patch availability despite early notification. An exploit has been publicly disclosed, including a proof-of-concept on GitHub, making it readily utilizable by attackers.
Details
- CWE(s)