CVE-2025-9603 is a medium severity (CVSS 6.3) command injection in the Telesquare TLR-2005KSH, firmware 1.2.4. The Hostname argument of /cgi-bin/internet.cgi?Command=lanCfg is not handled safely. The vendor did not respond to the disclosure, so restrict access to the web interface.
What's affected
The record lists the Telesquare TLR-2005KSH and its firmware, version 1.2.4. The affected file is /cgi-bin/internet.cgi with the lanCfg command, and the manipulated argument is Hostname. The description says the attack may be performed remotely and that the exploit has been publicly disclosed.
The record also states that the vendor was contacted early about the disclosure and did not respond in any way. That is the record's wording, and it matters here: there is no vendor advisory to point you to, and I could not confirm a fixed firmware. Check Telesquare's own support channel for your device.
The weaknesses are CWE-77 (command injection) and the parent class CWE-74 (injection). The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L: network reachable, low complexity, low privileges, no user interaction.
How to check if you're exposed
Read the firmware version in the device's status page, and note whether it is 1.2.4. Then see who can reach the web interface. From a different network, and only against addresses you own:
nmap -p 80,443,8080 <device-address>
A device that answers from the internet has its management page exposed. Review the admin accounts and the device log for logins and configuration changes you did not make.
What to do now
- Confirm the firmware version of each TLR-2005KSH you run.
- Remove the management interface from the internet, or restrict it to a VPN or fixed address range.
- Replace default and shared admin passwords.
- Ask Telesquare for firmware status and install a fixed build if one is released.
- Where the vendor stays silent, plan to replace the device and segment it from sensitive systems in the meantime.
Why it matters
The configuration page takes a hostname and hands it to something that runs a command on the device. If that value is not neutralised, text meant as a hostname can carry more instructions. Embedded web interfaces make this mistake often because they call shell tools directly.
A vendor that does not answer leaves defenders with network controls and replacement as the only options. The record says the CVE is not in the CISA Known Exploited Vulnerabilities catalog, and it does say a public exploit exists.
Quick check
Is there a fixed firmware for CVE-2025-9603?
None is named. The record says the vendor did not respond to the disclosure, so check with Telesquare directly.
Why is it medium and not high?
The vector requires low privileges, so the attacker needs an account on the interface, and each impact is rated low. Those factors give 6.3.
Sources
- Write up cited by the record: lin-cve repository entry
- Safeguard Gold entry: CVE-2025-9603
- CVE record fields as held in the Safeguard CVE record
Last reviewed: 18 October 2026.
