CVE-2021-45428

What it actually does

The affected Telesquare TLR-2005KSH firmware exposes HTTP PUT functionality without proper access control. A remote, unauthenticated attacker can upload arbitrary files to the device, including HTML files for content injection or CGI scripts that may execute server-side depending on web server configuration. Because the flaw is network-accessible, low-complexity, and requires no credentials or user interaction, successful exploitation can result in unauthorized file creation or replacement, web interface defacement, persistence through malicious uploaded content, remote command execution if uploaded CGI is executable, and full compromise of the device’s confidentiality, integrity, and availability.

Why it matters to the business

Compromise of an affected router or gateway can disrupt connectivity, expose traffic or configuration data, and allow the device to be used as a foothold into the surrounding network. The high CVSS score, weaponized exploit maturity, and elevated EPSS probability indicate meaningful real-world exploitation risk even though the issue is not currently listed in CISA KEV. Organizations using exposed TLR-2005KSH devices should treat this as urgent because edge devices are difficult to monitor, often internet-facing, and commonly abused for persistence, proxying, botnet activity, and attacks against internal systems.

How an attack unfolds

An attacker first identifies an exposed Telesquare TLR-2005KSH web management interface, typically through internet scanning or targeting known device fingerprints. The attacker then sends an unauthenticated HTTP PUT request to a writable path on the embedded web server. If the server accepts the request, the attacker uploads a file such as an HTML defacement page, a CGI web shell, or another script payload. The attacker then browses to the uploaded file to verify it is reachable and, where CGI execution is enabled, invokes the uploaded script to run commands or manipulate the device. After gaining control, the attacker may change configuration, implant additional files, proxy traffic through the device, harvest credentials or network settings, pivot toward reachable internal services, or enroll the device into malicious infrastructure.

How to fix it

Upgrade affected Telesquare TLR-2005KSH firmware to a vendor-provided fixed release if available. No fixed version information was provided in the input, so administrators should consult the vendor’s latest firmware advisories and support channels. If a fixed firmware is unavailable, remove management access from the internet, restrict the web management interface to a trusted administrative network or VPN, block HTTP PUT at an upstream firewall or reverse proxy where feasible, disable CGI execution if not required, and apply strong network segmentation around the device. Rotate device administrative credentials and review configuration after remediation because arbitrary file upload may have enabled persistence or configuration tampering. If the device cannot be adequately patched or isolated, plan replacement with a supported model.

How to confirm the fix worked

Confirm exposure by checking whether TLR-2005KSH devices are running the latest available firmware and whether their HTTP management interfaces are reachable from untrusted networks. Validate mitigation by ensuring unauthenticated HTTP PUT requests are rejected with an appropriate 401, 403, or 405 response and that uploaded test files cannot be created or retrieved. Review firewall rules, ACLs, and management-plane access controls to confirm only trusted administrative sources can reach the web interface. Inspect web-accessible directories for unexpected HTML, CGI, shell, or binary files. After firmware upgrade or configuration changes, rescan externally and internally to verify the device no longer accepts unauthorized file uploads.

Typical attack path

1. Scan for internet-exposed Telesquare TLR-2005KSH devices or matching HTTP service fingerprints.
2. Confirm the web server accepts unauthenticated HTTP PUT requests.
3. Upload an arbitrary file to a web-accessible directory, such as an HTML page or CGI script.
4. Request the uploaded file over HTTP to confirm write access and payload availability.
5. If CGI execution is supported, invoke the uploaded script to execute commands or establish a web shell.
6. Modify device configuration, add persistence, collect sensitive data, disrupt service, or use the device as a proxy or pivot point.

How to detect it

Review embedded web server access logs, upstream reverse proxy logs, firewall logs, IDS/IPS alerts, and network flow data for unauthenticated HTTP PUT requests to the device, especially requests that create .cgi, .sh, .php, .pl, .py, .html, or binary files. Look for subsequent HTTP GET or POST requests to the same uploaded path, which may indicate validation or web shell interaction. Examine device file systems for recently modified or unexpected files in web document roots and CGI-capable directories. Investigate anomalous outbound connections from the device, unusual DNS lookups, repeated connections to high-risk hosting providers, scanning behavior, or traffic inconsistent with normal router/gateway operations. Check configuration backups for unauthorized changes, added port forwards, modified DNS settings, new administrative users, altered firewall rules, or persistence mechanisms. Because exploitation may involve commodity tooling, prioritize behavioral evidence such as PUT followed by execution or repeated requests with command parameters rather than relying only on known actor-specific indicators.

• HTTP method: PUT
• "PUT /"
• "PUT /cgi-bin/"
• "PUT /cgi-bin/*.cgi"
• "PUT *.cgi"
• "PUT *.html"
• "PUT *.sh"
• "PUT *.pl"
• "PUT *.py"
• "PUT *.php"
• " 201 "
• " 204 "
• " 405 "
• "GET /cgi-bin/"
• "POST /cgi-bin/"
• "/cgi-bin/"
• "cmd="
• "command="
• "exec="
• "wget http"
• "curl http"
• "busybox"
• "/bin/sh"
• "chmod +x"
• "Content-Disposition: form-data"
• "Transfer-Encoding: chunked"

What your security team should do

• Immediately inventory Telesquare TLR-2005KSH devices and determine whether any management interfaces are exposed to the internet or untrusted networks.
• Prioritize remediation for exposed devices due to weaponized exploit availability, unauthenticated remote access, and high exploitation probability.
• Apply the latest vendor firmware if available; otherwise restrict management access, block HTTP PUT, and disable unnecessary CGI functionality.
• Search historical web server, firewall, IDS/IPS, and proxy logs for suspicious PUT requests and access to newly uploaded CGI or HTML files.
• Perform forensic review of affected devices for unauthorized files, altered startup or configuration settings, unknown user accounts, and evidence of proxying or command execution.
• Rotate administrative credentials and secrets stored on or transmitted through the device after remediation.
• Segment edge devices from internal systems and monitor outbound connections for unusual destinations, scanning behavior, or command-and-control patterns.
• Replace unsupported or unpatchable devices that cannot be safely isolated.