CVE-2017-20221 Telesquare SKT LTE Router SDT-CS3B1 CSRF System Command Execution
Authenticated attackers can execute arbitrary system commands on Telesquare LTE routers via CSRF, leading to full device compromise.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-20221?
CVE-2017-20221 is a medium-severity vulnerability in Telesquare SDT-CS3B1, published on 16 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Telesquare SKT LTE Router SDT-CS3B1 version 1.2.0 contains a cross-site request forgery vulnerability that allows authenticated attackers to execute arbitrary system commands by exploiting missing request validation. Attackers can craft malicious web pages that perform administrative actions when visited by logged-in users, enabling command execution with router privileges.
Weakness: CWE-352
Which versions are affected by CVE-2017-20221?
It affects 1 product.
Products include Telesquare Sdt-Cs3b1 Firmware.
How do I fix CVE-2017-20221?
No fix has been published for CVE-2017-20221 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-20221 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-20221 exists.
Other vulnerabilities in Telesquare SDT-CS3B1
- CVE-2021-46422 Command injection in n/a
- CVE-2018-12526 Hardcoded credentials in n/a
- CVE-2017-20223 Telesquare SKT LTE Router SDT-CS3B1 Insecure Direct Object Reference
- CVE-2017-20224 Telesquare SKT LTE Router SDT-CS3B1 WebDAV Arbitrary File Upload
- CVE-2017-20222 Telesquare SKT LTE Router SDT-CS3B1 Unauthenticated Remote Reboot
Sources
Also known as GHSA-98cj-p4cp-mf8h.