Loading vulnerability…
CVE-2024-29269 is a command injection vulnerability affecting Telesquare TLR-2005KSH routers in versions 1.0.0 and 1.1.4. The flaw allows an attacker to supply arbitrary operating system commands through the Cmd parameter, resulting in unauthorized remote code execution on the underlying system. The issue is described as exploitable without authorization, indicating that exposed vulnerable devices may be compromised remotely if the affected interface is reachable.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
5 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a Nuclei template (CVE-2024-29269.yaml) for detecting and exploiting an unauthenticated remote command execution vulnerability (CVE-2024-29269) in Telesquare TLR-2005KSH LTE routers, specifically versions 1.0.0 and 1.1.4. The exploit works by sending a crafted HTTP GET request to the '/cgi-bin/admin.cgi' endpoint with the 'Cmd' parameter set to an arbitrary system command (e.g., 'ifconfig'). If the target is vulnerable, the response will contain the command output, confirming code execution. The template includes matchers for response content and headers to verify exploitation. The README provides a brief description, search dorks for finding vulnerable devices, and a disclaimer. The repository is structured with a single YAML file for the Nuclei framework and a README, making it a proof-of-concept exploit for security testing and vulnerability scanning.
This repository provides a Python exploit for CVE-2024-29269, a critical unauthenticated OS command execution vulnerability affecting TLR-2005KSH routers. The main exploit file, 'exploit.py', implements both interactive and batch scanning modes. In interactive mode, users can execute arbitrary commands on a single target URL and receive the output, effectively providing a remote shell-like experience. In batch mode, the tool can scan a list of URLs for vulnerable devices and log successful findings to an output file. The exploit works by sending crafted HTTP GET requests to the '/cgi-bin/admin.cgi' endpoint with the 'Command=sysCommand' and a user-supplied 'Cmd' parameter, leveraging the vulnerability to execute commands on the router's operating system. The code parses XML responses to extract command output. The repository also includes a README with detailed usage instructions and a requirements.txt for dependencies. No hardcoded credentials or IPs are present; the tool is designed for flexible targeting via user-supplied URLs or files. The exploit is operational and provides real command execution on vulnerable devices.
This repository provides a Python exploit script (exploit.py) targeting CVE-2024-29269, a remote code execution vulnerability. The exploit works by sending a crafted HTTP GET request to the /cgi-bin/admin.cgi endpoint on a vulnerable server, injecting a command via the Cmd parameter. The script parses the response to extract and display the output of the executed command. The repository includes a README.md with installation and usage instructions, a requirements.txt listing dependencies (requests, colorama), and the main exploit script. The exploit is operational, allowing the user to specify a target URL and command to execute. No hardcoded IPs or domains are present; the user supplies the target. The attack vector is network-based, exploiting a web-accessible CGI endpoint. The code is straightforward and functional, suitable for testing or demonstration purposes.
This repository provides a Python exploit for CVE-2024-29269, a vulnerability in TLR-2005KSH routers that allows unauthenticated remote OS command execution. The main file, 'exploit.py', implements both interactive and batch modes. In interactive mode, a user can connect to a single target URL and execute arbitrary shell commands, receiving the output from the device. In batch mode, the script can scan multiple URLs (provided in a file) for vulnerability and optionally write the list of vulnerable URLs to an output file. The exploit works by sending crafted HTTP GET requests to the '/cgi-bin/admin.cgi?Command=sysCommand&Cmd={command}' endpoint on the target device, where the 'Cmd' parameter is user-supplied. The response is expected to be XML containing the command output. The code includes features such as a progress bar, colored output, and an interactive shell for command execution. The repository also includes a README with usage instructions and a requirements.txt for dependencies. No hardcoded IPs or domains are present; targets are user-supplied. The exploit is operational and provides real command execution on vulnerable routers.
This repository contains a Python proof-of-concept exploit for CVE-2024-29269, a remote code execution vulnerability in Telesquare TLR-2005KSH routers (versions 1.0.0 and 1.1.4). The exploit targets the /cgi-bin/admin.cgi endpoint, abusing the Cmd parameter to execute arbitrary system commands on the device. The main script (CVE-2024-29269.py) provides both single-target and multi-target scanning, checks for vulnerability by looking for command output markers in the response, and, if successful, launches an interactive shell allowing the attacker to run arbitrary commands on the device. The exploit is network-based, requiring HTTP access to the device's web interface. The README provides context and a disclaimer, while the code file contains all exploit logic, including command execution and interactive shell functionality.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A command injection vulnerability in Telesquare TLR-2005KSH that Evooo1Bot was observed exploiting.
An unauthorized remote code execution vulnerability in Telesquare routers, with proof-of-concept exploit released, affecting 40,000 devices.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.