EUVD-2017-18939Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Impact | This vulnerability presents a critical real-world risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates it's remotely exploitable over the network with low attack complexity, requires no privileges or user interaction, and impacts confidentiality, integrity, and availability at the highest level. The existence of multiple public exploits (Exploit-DB, PacketStorm Security) significantly increases the risk. While no EPSS score or KEV listing is mentioned, the combination of a weaponized exploit, network accessibility, and complete system compromise capability makes this a priority vulnerability for any organization using affected routers. |
| Exploit ScenarioDerived | An attacker can remotely exploit this vulnerability without any credentials or user interaction. By manipulating URL parameters or form inputs sent to the router's web interface, the attacker can directly reference and access sensitive objects such as configuration files, user credentials, or administrative functions. Given the public availability of working exploits on Exploit-DB (#43402) and PacketStorm Security, even low-skilled attackers can compromise these routers to gain full control, potentially accessing the internal network, intercepting traffic, or using the device as a pivot point for further attacks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
An insecure direct object reference vulnerability in Telesquare SKT LTE Router SDT-CS3B1 firmware version 1.2.0 allows remote attackers to bypass authentication and directly access sensitive resources by manipulating input parameters. With a publicly available proof-of-concept exploit and a critical CVSS score of 9.8, attackers can gain unauthorized access to sensitive information and system functionalities without any authentication or user interaction required.
RemediationAI
No specific patch information is provided in the available references. Organizations should immediately contact Telesquare for an updated firmware version beyond 1.2.0. As an interim mitigation, affected routers should be placed behind additional security controls, access should be restricted to trusted IP addresses only, and network segmentation should be implemented to limit potential impact. Monitor router logs for suspicious access attempts and consider replacing the device if no patch is available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects the Telesquare SDT-CS3B1 LTE router, specifically firmware version 1.2.0 (CPE: cpe:2.3:a:telesquare:sdt-cs3b1:*:*:*:*:*:*:*:*). This is an insecure direct object reference (IDOR) vulnerability classified as CWE-639, which occurs when an application exposes direct references to internal objects like database keys or filenames in URLs or form parameters. Attackers can manipulate these references to access unauthorized data or functionality, effectively bypassing the router's authentication mechanisms.
Know when Sdt Cs3b1 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Telesquare SKT LTE Router SDT-CS3B1 firmware version 1.2.0 contains an insecure direct object reference vulnerability that allows attackers to bypass authorization and access resources by manipulating user-supplied input parameters. Attackers can directly reference objects in the system to retrieve sensitive information and access functionalities without proper access controls.
Executive ViewAI
A critical authentication bypass vulnerability (CVE-2017-20223) in Telesquare SKT LTE Router SDT-CS3B1 firmware allows remote attackers to access sensitive system resources without credentials. With a publicly available exploit and no patch available, any organization using this router model faces immediate risk of unauthorized access to network infrastructure, configuration data, and potentially lateral movement into connected systems.
Implement network segmentation to restrict direct access to affected routers; disable all remote management interfaces (SSH, HTTP, HTTPS); place routers behind an authenticated WAF or proxy with strict access controls; restrict router management to dedicated administrative VLANs only; implement intrusion detection rules to monitor for CVE-2017-20223 exploitation attempts; consider complete hardware replacement as this device is unsupported and no patch will be available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Exploit-DB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GitHub PoC