Injeção de Código na Configuração (Config-Upload Code Injection)

The impact of this vulnerability is severe. Successful exploitation allows an unauthenticated attacker to upload arbitrary code to the TC ROUTER 3002T-3G as the root user. This grants complete control over the device, enabling attackers to modify configurations, steal sensitive data, install malware, and potentially pivot to other systems on the network. The lack of authentication required for the upload makes this vulnerability particularly dangerous, as it can be exploited remotely without any prior credentials. The resulting loss of confidentiality, availability, and integrity poses a significant risk to organizations relying on these routers.

Organizations deploying TC ROUTER 3002T-3G devices, particularly those in environments with limited network segmentation, are at significant risk. Shared hosting environments where multiple users share a single router are also vulnerable, as a compromise of one user's account could potentially lead to a compromise of the entire router.

• windows / supply-chain: Monitor network traffic for POST requests to the config-upload endpoint. Examine scheduled tasks for suspicious entries created after a potential compromise. • linux / server: Use journalctl to filter for log entries related to file uploads and code execution. Implement auditd rules to monitor access to the config-upload endpoint. • generic web: Use curl to test the config-upload endpoint with a benign payload and verify that the upload is rejected or handled securely. Check access logs for unusual activity related to the endpoint.

1. 2026-01-13Disclosure

   disclosure

1. Reservado2025-04-16
2. Publicada2026-01-13
3. Modificada2026-02-05
4. EPSS atualizado2026-03-23

The primary mitigation for CVE-2025-41717 is to immediately upgrade the TC ROUTER 3002T-3G to version 3.08.8 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting access to the config-upload endpoint using a firewall or access control list (ACL). Monitoring network traffic for suspicious uploads to the endpoint can also help detect potential exploitation attempts. After upgrading, verify the fix by attempting to upload a benign test file through the config-upload endpoint and confirming that the upload is rejected or handled securely.