CVE-2021-46422: Telesquare SDT-CW3B1 router OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote OS command injection with a 9.8 CVSS score, public exploit code and a 99.8th percentile EPSS probability makes this an urgent fix.

What it is

Telesquare SDT-CW3B1 1.1.0 contains an OS command injection flaw (CWE-78) that lets a remote attacker run arbitrary operating system commands. The vulnerability is rated critical (CVSS 3.1 9.8) and requires no authentication or user interaction, making any exposed device a direct target.

Impact

An attacker gains unauthenticated remote code execution on the device, allowing full compromise of confidentiality, integrity and availability. This can be used to pivot into the network the device sits on or to enroll it in a botnet.

Attack surface

The flaw is reachable over the network (AV:N) with no privileges (PR:N) and no user interaction (UI:N), so any internet- or LAN-exposed SDT-CW3B1 1.1.0 interface is a candidate. No credentials are needed to trigger the injection.

Exploitation

CISA KEV does not list this CVE, but public exploit code is referenced (Packet Storm and a Google Drive link tagged Exploit) and EPSS is very high at 0.94342 (99.8th percentile), indicating active exploitation is likely.

What to do

• Apply the vendor fix for SDT-CW3B1 1.1.0 or later if available; if no patch exists, replace or retire the device.
• Remove the device from direct internet exposure and restrict management access to trusted internal networks only.
• Place the device behind a firewall or reverse proxy that filters requests to the vulnerable endpoint.
• Monitor vendor advisories for a patched firmware release and schedule immediate upgrade.
• If the device cannot be patched or isolated, power it down or replace it with a supported product.

Detection

• Inspect web server or device logs for requests containing shell metacharacters (;, |, $(), backticks) to the vulnerable endpoint.
• Alert on unexpected outbound connections or process execution from the SDT-CW3B1 device.
• Use network monitoring to flag anomalous traffic to and from the device's management interface.
• Search for known exploit payload strings from the public Packet Storm references in HTTP request logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.