Cyber Resilience

CVE-2025-9603

LowPublic PoC

Published: 29 August 2025

Published
29 August 2025
Modified
29 April 2026
KEV Added
Patch
CVSS Score v4 2.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0145 81.2th percentile
Risk Priority 5 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-9603 is a low-severity Injection (CWE-74) vulnerability in Telesquare Tlr-2005Ksh Firmware. Its CVSS base score is 2.1 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked in the top 18.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).

Deeper analysis

CVE-2025-9603 is a command injection vulnerability in Telesquare TLR-2005KSH version 1.2.4. The flaw resides in an unspecified function within the file /cgi-bin/internet.cgi?Command=lanCfg, where improper handling of the Hostname argument permits injection of arbitrary commands. The issue is tracked under CWE-74 and CWE-77 and carries a CVSS 4.0 score of 2.1.

An authenticated remote attacker can supply a crafted Hostname value to the affected CGI endpoint and execute operating-system commands on the device. The attack requires no user interaction and can be launched over the network; a working exploit has already been published.

No vendor patch or official advisory is available, as Telesquare did not respond to disclosure. Public references consist of a GitHub repository containing a proof-of-concept and several VulDB entries that document the flaw.

The EPSS score remains flat at 0.0145 with no material increase since publication, indicating limited observed exploitation interest to date.

EU & UK References

Vulnerability details

A vulnerability was determined in Telesquare TLR-2005KSH 1.2.4. The affected element is an unknown function of the file /cgi-bin/internet.cgi?Command=lanCfg. Executing manipulation of the argument Hostname can lead to command injection. The attack may be performed from a remote location. The…

more

exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1202 Indirect Command Execution Stealth
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
Why these techniques?

Command injection via public-facing web CGI (/cgi-bin/internet.cgi?Command=lanCfg) enables exploitation of public-facing applications (T1190), indirect command execution through parameter manipulation (T1202), and command/script interpreter abuse (T1059, likely Unix Shell on the device).

CVEs Like This One

CVE-2025-26005Same product: Telesquare Tlr-2005Ksh
CVE-2025-26004Same product: Telesquare Tlr-2005Ksh
CVE-2025-26007Same product: Telesquare Tlr-2005Ksh
CVE-2025-26002Same product: Telesquare Tlr-2005Ksh
CVE-2025-26010Same product: Telesquare Tlr-2005Ksh
CVE-2025-26008Same product: Telesquare Tlr-2005Ksh
CVE-2025-26006Same product: Telesquare Tlr-2005Ksh
CVE-2025-26011Same product: Telesquare Tlr-2005Ksh
CVE-2025-26003Same product: Telesquare Tlr-2005Ksh
CVE-2025-26001Same product: Telesquare Tlr-2005Ksh

Affected Assets

telesquare
tlr-2005ksh firmware
1.2.4

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation and sanitization of untrusted input (Hostname) to block command injection into internet.cgi.

prevent

Limits privileges of the low-privilege account so that any injected commands have minimal impact on confidentiality, integrity, and availability.

prevent

Restricts unnecessary CGI functionality and interfaces, reducing the attack surface that exposes the vulnerable lanCfg command.

References