CVE-2021-45428: Telesquare TLR-2005KSH router allows arbitrary file upload via PUT

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or interaction required, public exploit references, and a very high EPSS score make this an urgent exposure for any internet-facing TLR-2005KSH device.

What it is

TLR-2005KSH firmware is affected by an incorrect access control flaw: the HTTP PUT method is enabled, letting an attacker upload arbitrary files, including HTML and CGI. Because uploaded CGI can be executed, this is effectively remote code execution on the device. The record does not list specific affected firmware versions.

Impact

An unauthenticated attacker can place arbitrary files on the device and execute uploaded CGI, gaining code execution with the web server's privileges and full control over confidentiality, integrity and availability.

Attack surface

Reachable over the network via HTTP with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet- or LAN-exposed TLR-2005KSH management interface is a candidate target.

Exploitation

Not listed in CISA KEV, but EPSS is 0.56931 (99th percentile) and public references are tagged Exploit, indicating exploit code is publicly available and exploitation is likely.

What to do

• Apply the vendor firmware update for TLR-2005KSH if one is available; the record does not name a fixed version, so confirm with Telesquare.
• If no patch exists, disable the HTTP PUT method on the device or block it at a reverse proxy/WAF.
• Remove the management interface from the public internet; restrict access to a trusted management VLAN or VPN.
• Disable or restrict CGI execution on the device where the configuration allows it.
• Replace end-of-life devices that cannot be patched or hardened.

Detection

• Alert on HTTP PUT requests to the TLR-2005KSH web interface, especially with .html, .cgi or script-like extensions.
• Monitor the device's web root and upload directories for newly created or modified files.
• Watch for unexpected processes spawned by the device's web server or outbound connections from the device after uploads.
• Review web server logs for PUT requests returning 200/201 from untrusted source IPs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.