CVE-2024-29269

This vulnerability is like a “backdoor command box” hidden in the device: if someone can reach the device from the nearby network, they can send the right input and force it to execute operating system commands.
For a small business, that can mean the device is no longer just routing traffic—it can become a launch point to interfere with your systems or steal information.

This matters if you run Telesquare TLR-2005Ksh (firmware 1.0.0 or 1.1.4) and the device can be reached from the “adjacent network” (nearby network zone) by an attacker.
There is no authentication required and no user action needed for the malicious command to be triggered.
The risk is highest when network isolation is weak—i.e., an attacker can reach the device from the adjacent network—because exploitation does not require credentials.

This is urgent because exploitation has been reported in the wild, including activity by the Evooo1Bot botnet, which targets internet-facing and other reachable devices to establish access.
Given that the weakness allows arbitrary command execution without authentication, any reachable affected device should be treated as actively exploitable now.

Confirm exposure

• Identify the exact firmware version on your Telesquare TLR-2005Ksh.
• Consider your system affected if it is running 1.0.0 or 1.1.4.

Immediate containment (even before a fixed update is available)

• Network segmentation: Place the device on its own network/VLAN so only your approved admin system(s) can talk to it.
• Firewall restriction: Block inbound access to the device from anything except the necessary management sources/destinations.
• IDS/IPS protection: Ensure IDS/IPS is enabled between the adjacent network zones and the device’s network. Use detections for command-injection-like behavior (based on the presence of the “Cmd” style command input patterns) and confirm you get blocks/alerts during testing.

Upgrade / fix status

• The provided vendor remediation guidance focuses on compensating controls (firewalling and IDS/IPS) and does not list a specific fixed firmware version in the findings you supplied.
• Contact vendor/support to obtain the fixed firmware for TLR-2005Ksh and plan an upgrade as soon as it is released/confirmed.

Temporary workaround if you cannot patch immediately

• Treat firewall isolation + IDS/IPS as the primary mitigation until a fixed firmware version is available.
• Reduce the number of systems that can reach the device (principle of least connectivity), and regularly review IDS/IPS alerts.

What to monitor

• IDS/IPS events indicating command injection or abnormal command-like payloads.
• Unexpected management access attempts from unexpected adjacent-network hosts.
• Device behavior changes after any alert (unexpected outbound connections, configuration changes, or service restarts).

Severity is high (CVSS 8.8) and the flaw is classified as CWE-77 (Command Injection). The mechanism is command injection through a specific input parameter (Cmd), allowing an attacker to cause arbitrary system command execution on the device.

Attack requirements from the findings:

• No authentication required
• No user interaction required
• Adjacent Network reachability (attacker must be in the nearby network zone)

Exploitation status:

• Public PoCs exist (GitHub PoC) and exploitation has been reported.
• KEV is not listed in CISA KEV, but press/botnet reporting indicates active exploitation by Evooo1Bot starting July 2026.

EPSS is provided as a prediction only; this is not used as a basis for urgency because exploitation was reported. KEV absence means there may be no official CISA bulletin for this exact CVE yet, so mitigation should rely on technical exposure (reachability) and compensating controls while awaiting a confirmed fixed firmware.