CVE-2025-9603 in TLR-2005KSH
Summary
by MITRE • 08/29/2025
A vulnerability was determined in Telesquare TLR-2005KSH 1.2.4. The affected element is an unknown function of the file /cgi-bin/internet.cgi?Command=lanCfg. Executing manipulation of the argument Hostname can lead to command injection. The attack may be performed from a remote location. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/11/2025
The vulnerability identified as CVE-2025-9603 affects the Telesquare TLR-2005KSH router model running firmware version 1.2.4, representing a critical command injection flaw within the device's web interface management functionality. This vulnerability resides in the /cgi-bin/internet.cgi script with the specific parameter Command=lanCfg, where the Hostname argument fails to properly sanitize user input before processing. The flaw allows remote attackers to execute arbitrary commands on the affected device by manipulating the Hostname parameter, effectively bypassing authentication mechanisms and gaining unauthorized access to the underlying system.
This vulnerability demonstrates characteristics consistent with CWE-77 and CWE-94, specifically addressing command injection and code injection weaknesses where user-controllable input is directly incorporated into system commands without proper validation or sanitization. The attack vector is particularly concerning as it enables remote exploitation without requiring authentication, making it accessible to any attacker with network connectivity to the device. The vulnerability's classification as a remote command injection issue places it within the ATT&CK framework under T1059.001 - Command and Scripting Interpreter: PowerShell and T1059.007 - Command and Scripting Interpreter: Python, as attackers can leverage this flaw to execute system commands directly on the compromised device.
The operational impact of this vulnerability extends beyond simple unauthorized access, as it provides attackers with complete control over the router's functionality and potentially the entire network segment it serves. Attackers could manipulate network configurations, redirect traffic, establish backdoors, or use the device as a pivot point for further network reconnaissance and lateral movement. The fact that this vulnerability has been publicly disclosed and is already being exploited in the wild significantly increases the risk to organizations that have not yet patched their affected devices, as the attack surface remains open for unauthorized access and potential data breaches.
Organizations should immediately implement mitigations including network segmentation to isolate affected devices, disabling unnecessary remote management features, and applying firmware updates once available from the vendor despite the lack of response to prior notifications. Network monitoring should be enhanced to detect anomalous command execution patterns, and access controls should be strictly enforced using firewall rules to restrict access to the affected CGI scripts. Additionally, implementing intrusion detection systems with signature-based detection for known command injection patterns can help identify exploitation attempts. The vulnerability highlights the importance of maintaining up-to-date firmware and establishing robust vulnerability management processes that include proactive vendor communication and rapid response protocols to address security issues before public disclosure.