Telesquare TLR-2005KSH internet.cgi command injection
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.
Summary
A vulnerability was determined in Telesquare TLR-2005KSH 1.2.4. The affected element is an unknown function of the file /cgi-bin/internet.cgi?Command=lanCfg. Executing manipulation of the argument Hostname can lead to command injection. The attack may be performed from a remote location. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Telesquare | TLR-2005KSH | 1.2.4 | — | No fix listed | CNA |
- TLR-2005KSH VendorTelesquare Affected 1.2.4 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:telesquare:tlr-2005ksh_firmware:1.2.4:*:*:*:*:*:*:* | 1.2.4 | Vulnerable | Telesquare |
| cpe:2.3:h:telesquare:tlr-2005ksh:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Telesquare |
- cpe:2.3:o:telesquare:tlr-2005ksh_firmware:1.2.4:*:*:*:*:*:*:* Versions 1.2.4 Vulnerable ·Telesquare
- cpe:2.3:h:telesquare:tlr-2005ksh:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Telesquare
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-9603
- 2026-10-03 Alias added: GHSA-586x-47fh-9m4v
References
Exploit 2
- https://github.com/lin-3-start/lin-cve/blob/main/Telesquare%20Tlr-2005Ksh/Telesquare%20Tlr-2005Ksh%E5%AD%98%E5%9C%A8%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
- https://github.com/lin-3-start/lin-cve/blob/main/Telesquare%20Tlr-2005Ksh/Telesquare%20Tlr-2005Ksh%E5%AD%98%E5%9C%A8%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md#3poc
More Telesquare Tlr-2005ksh Firmware vulnerabilities
- TI-2021-20527 TLR-2005KSH is affected by an incorrect access control vulnerability. CVSS 3.1CRITICAL 9.8
- TI-2024-19412 An issue discovered in Telesquare TLR-2005Ksh 1.0.0 and 1.1.4 allows attackers to run… CVSS 3.1HIGH 8.8
- TI-2021-21226 Telesquare TLR-2005KSH 1.0.0 is affected by an arbitrary file deletion vulnerability that… CVSS 3.1CRITICAL 9.1
- TI-2025-19220 Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized command execution… CVSS 3.1CRITICAL 9.8
- TI-2025-19228 Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability when… CVSS 3.1CRITICAL 9.8
- TI-2025-19227 Telesquare TLR-2005KSH 1.1.4 allows unauthorized password modification when requesting… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-9603 · CVE Program
- CVE-2025-9603 · NVD
- FIRST EPSS
- GHSA-586x-47fh-9m4v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences