CVE-2021-46419

What it actually does

CVE-2021-46419 is an unauthenticated authorization bypass in Telesquare TLR-2855KS6 firmware that allows a remote attacker to issue HTTP DELETE requests to remove files from the device without valid credentials. Because the affected interface improperly authorizes file deletion operations, an attacker can delete system files, configuration files, web interface scripts, or operational scripts. The direct impact is loss of integrity and availability: files can be removed or corrupted, device services can break, and the appliance may become unstable or inoperable. The flaw does not directly provide confidentiality impact, but deleting security controls, startup scripts, or application components may support follow-on compromise depending on device configuration.

Why it matters to the business

Successful exploitation can disrupt network connectivity, break device management, remove operational scripts, or render affected Telesquare devices unreliable or unavailable. For organizations using these devices in production network paths, this can cause outages, remote-site connectivity loss, emergency maintenance, device replacement, and extended recovery windows if backups or firmware images are unavailable. The vulnerability has a high CVSS score, high EPSS probability, and is marked as weaponized, so internet-exposed devices should be treated as high-priority even though it is not currently listed in CISA KEV and is not specifically associated with ransomware campaigns.

How an attack unfolds

An attacker first identifies an exposed Telesquare TLR-2855KS6 management interface, commonly through internet scanning or targeted probing of known device fingerprints. The attacker then sends unauthenticated HTTP DELETE requests to the vulnerable endpoint or file path exposed by the device firmware. Because the firmware fails to enforce authorization before performing the delete operation, the device accepts the request and removes the targeted file. The attacker may delete web scripts, configuration artifacts, service scripts, or other files needed for normal operation. After deletion, device functionality may degrade immediately or after restart, depending on the targeted file. In a destructive scenario, the attacker repeats the process across multiple files or devices to cause broad service disruption. In a follow-on scenario, the attacker may delete logs, management components, or protective scripts to impair detection and recovery.

How to fix it

Apply an updated firmware release from Telesquare if available through the vendor or authorized support channel. No fixed version was provided in the supplied advisory data, so organizations should verify directly with the vendor, distributor, or device support portal whether corrected firmware exists for TLR-2855KS6. Until a fixed firmware is confirmed and deployed, restrict access to the device management interface: remove it from direct internet exposure, place it behind a VPN or administrative jump host, limit access by source IP allowlist, and block unauthenticated HTTP DELETE requests at a firewall, reverse proxy, or web application firewall where feasible. Disable unused remote management services and ensure device configurations and firmware images are backed up before remediation. If exploitation is suspected or files are missing, reimage or factory-reset the device using trusted firmware rather than attempting piecemeal repair, then restore known-good configuration backups.

How to confirm the fix worked

Confirm asset inventory for Telesquare TLR-2855KS6 devices and verify whether any management interface is reachable from untrusted networks. Check the running firmware version and compare it with the latest vendor-supported release or any vendor-provided security advisory. Validate network controls by attempting to reach the management interface only from approved administrative networks and confirming access is denied from all other sources. Review HTTP access logs or upstream proxy/firewall logs to confirm that DELETE requests are blocked or require authentication. Where safe and authorized, perform a non-destructive vulnerability validation using a test path or vendor-recommended scanner method; do not test by deleting production files. After firmware update or mitigation, verify normal device operation, persistence across reboot, and absence of unexpected missing files or broken management pages.

Typical attack path

1. Scan for internet-exposed Telesquare TLR-2855KS6 devices or management interfaces.
2. Confirm the device or firmware family using HTTP banners, page content, paths, or response behavior.
3. Send unauthenticated HTTP DELETE requests to file paths handled by the vulnerable firmware.
4. Delete system files, scripts, configuration files, or management interface components.
5. Verify impact by observing changed HTTP responses, missing resources, service failures, or device instability.
6. Optionally repeat deletion across additional files or devices to increase disruption or impede recovery.

How to detect it

Look for evidence of unauthenticated or unexpected HTTP DELETE activity against Telesquare TLR-2855KS6 management interfaces. Primary log sources include device web server logs, embedded management interface logs, upstream reverse proxy logs, firewall logs, IDS/IPS telemetry, VPN logs, and network flow records. Search for HTTP method DELETE requests, especially from unknown external IP addresses, repeated DELETE attempts, requests targeting script or system-like paths, and DELETE requests returning successful status codes such as 200, 202, or 204. Also investigate spikes in 404 or 500 responses after DELETE activity, because deleted web scripts or resources may cause management pages to fail. On devices, check for missing or modified scripts, broken management UI components, unexpected service failures, boot errors, or abrupt changes in configuration availability. Because attackers may delete files to create denial of service rather than persistence, absence of classic malware artifacts does not rule out exploitation. If centralized logging is unavailable, use upstream network telemetry to identify DELETE requests to affected device IPs and correlate them with device degradation, reboots, or support incidents.

• HTTP method: DELETE
• "DELETE /"
• "DELETE /cgi-bin/"
• "DELETE /scripts/"
• "DELETE /admin/"
• "DELETE /config"
• "DELETE /etc/"
• "DELETE /tmp/"
• "DELETE /var/"
• "DELETE /www/"
• "DELETE /web/"
• "DELETE /index"
• "DELETE" status=200
• "DELETE" status=202
• "DELETE" status=204
• "DELETE" 200
• "DELETE" 202
• "DELETE" 204
• "Telesquare"
• "TLR-2855KS6"

What your security team should do

• Immediately inventory Telesquare TLR-2855KS6 devices and determine whether any management interface is internet-accessible.
• Treat exposed devices as urgent due to weaponized exploit maturity, high CVSS severity, and high EPSS likelihood.
• Remove direct internet exposure and restrict management access to trusted administrative networks or VPN-only access.
• Contact Telesquare or the authorized supplier for patched firmware or replacement guidance if no fixed version is publicly documented.
• Block or alert on HTTP DELETE requests to device management interfaces unless explicitly required and authenticated.
• Review historical web, proxy, firewall, and device logs for suspicious DELETE requests and missing-file symptoms.
• Back up known-good configurations and retain trusted firmware images for rapid recovery.
• If exploitation is suspected, reimage or factory-reset affected devices from trusted media and rotate any credentials used to administer them.
• Monitor for device instability, failed web resources, unexpected reboots, or management interface errors that may indicate deleted files.