CVE-2025-41717: Code Injection in TC ROUTER 3002T-3G

The impact of this vulnerability is severe. Successful exploitation allows an unauthenticated attacker to upload arbitrary code to the TC ROUTER 3002T-3G as the root user. This grants complete control over the device, enabling attackers to modify configurations, steal sensitive data, install malware, and potentially pivot to other systems on the network. The lack of authentication required for the upload makes this vulnerability particularly dangerous, as it can be exploited remotely without any prior credentials. The resulting loss of confidentiality, availability, and integrity poses a significant risk to organizations relying on these routers.

1. Reserved2025-04-16
2. Published2026-01-13
3. Modified2026-02-05
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-41717 is to immediately upgrade the TC ROUTER 3002T-3G to version 3.08.8 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting access to the config-upload endpoint using a firewall or access control list (ACL). Monitoring network traffic for suspicious uploads to the endpoint can also help detect potential exploitation attempts. After upgrading, verify the fix by attempting to upload a benign test file through the config-upload endpoint and confirming that the upload is rejected or handled securely.