CVE-2021-46418: An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts.

PriorityP262high7.5CVSS 3.1

AVNACLPRNUINSUCNIHAN

EXPLOIT

EPSS

23.95%

97.6th percentile

An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts.

Detection & IOCsextracted from sources · hover to see the quote

path/cgi-bin/testing_cve.txt↗

path/cgi-bin/{{filename}}.txt↗

commandPUT /cgi-bin/<filename>.txt HTTP/1.1↗

→Detect unauthenticated HTTP PUT requests targeting the /cgi-bin/ directory on Telesquare TLR-2855KS6 devices; a successful file creation returns HTTP 201. ↗
→Fingerprint vulnerable devices using the FOFA query for the product banner string TELESQUARE-TLR-2855KS6. ↗
→Confirm exploitation by issuing a follow-up GET to the created file path and checking that the response Content-Type is text/plain and the body contains the previously PUT content. ↗
→The device runs lighttpd; presence of the lighttpd Server header combined with a 201 response to a PUT on /cgi-bin/ is a strong indicator of a vulnerable and exploited device. ↗

·The exploit PoC uses a static test filename (testing_cve.txt); real attackers would likely use arbitrary filenames including .cgi scripts for remote code execution, so detection should not be limited to this specific filename. ↗
·The vulnerability requires no authentication (PR:N, UI:N per CVSS), meaning any network-reachable device is at risk without any credential bypass needed. ↗

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.