PT-2024-3188 · Telesquare · Tlr-2005Ksh

Published 2024-04-08 · Updated 2025-06-17 · CVE-2024-29269

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Telesquare TLR-2005Ksh versions 1.0.0 through 1.1.4

Description The issue allows attackers to run arbitrary system commands via the Cmd parameter, potentially leading to data breaches or network compromise. It is estimated that over 40,000 devices may be affected. The vulnerability can be exploited to execute system commands without authorization.

Recommendations For versions 1.0.0 through 1.1.4, as a temporary workaround, consider disabling the use of the Cmd parameter until a patch is available. Restrict access to the vulnerable module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2024-03408

CVE-2024-29269

Affected Products

Tlr-2005Ksh

References · 32

• 🔥 https://github.com/Chocapikk/CVE-2024-29269 · Exploit
• 🔥 https://github.com/K3ysTr0K3R/CVE-2024-29269-EXPLOIT · Exploit
• 🔥 https://github.com/wutalent/CVE-2024-29269/blob/main/index.md · Exploit
• 🔥 https://github.com/hack-with-rohit/CVE-2024-29269-RCE · Exploit
• 🔥 https://github.com/wutalent/CVE-2024-29269 · Exploit
• https://osv.dev/vulnerability/CVE-2024-29269 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03408 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-29269 · Security Note
• https://t.me/thedarkwebinformer/17705 · Telegram Post
• https://twitter.com/testalways/status/1793515044619334068 · Twitter Post
• https://vuldb.com/ru/?id.260343 · Note
• https://t.me/cybersecuritytechnologies/10562 · Telegram Post
• https://t.me/proxy_bar/1996 · Telegram Post
• https://twitter.com/rst_cloud/status/1837592471531843818 · Twitter Post
• https://t.me/cvenotify/76416 · Telegram Post