CVE-2025-26002

Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setSyncTimeHost

Critical · published March 26, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
42.1
In the wild
Unconfirmed
What it is

🔥 An unauthorized stack overflow in Telesquare TLR-2005KSH could turn your admin controls into an attacker's playground! Think of it like a crowded restaurant where one patron can trigger an avalanche of chaos by taking all the orders at once, overwhelming the staff and causing havoc. That's what happens here when the stack overflows due to the unregulated admin.cgi parameter! An attacker could exploit this vulnerability to gain unauthorized access, potentially leading to system takeover, data manipulation, or service disruption. It’s a ticket to the back office, where they can wreak havoc on your systems without breaking a sweat! This is not just a nuisance; it could lead to absolute chaos in your operations!

Put simply

Think of it like a crowded restaurant where one patron can trigger an avalanche of chaos by taking all the orders at once, overwhelming the staff and causing havoc. That's what happens here when the stack overflows due to the unregulated admin.cgi parameter! This stack overflow vulnerability allows attackers to manipulate the setSyncTimeHost parameter in admin.cgi, resulting in unauthorized actions that could compromise the entire system.

What to do

An attacker could exploit this vulnerability to gain unauthorized access, potentially leading to system takeover, data manipulation, or service disruption. It’s a ticket to the back office, where they can wreak havoc on your systems without breaking a sweat! This is not just a nuisance; it could lead to absolute chaos in your operations! Upgrade to version 1.1.5 immediately to mitigate this vulnerability. Additionally, consider implementing strict input validation and monitoring for any suspicious activity on admin endpoints to bolster your defenses. You've got this! By following these steps, you’ll ensure your admin access stays secure and your systems protected. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00503 · 42.1th percentile
Published
2025-03-26T00:00Z
EPSS history
Timeline
  • 26 MAR 00:00Z
    Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setSyncTimeHost
    cvelistv5