CVE-2017-20222: Telesquare LTE Router DoS Vulnerability

CVE-2017-20222 Overview

CVE-2017-20222 is an authentication bypass vulnerability affecting the Telesquare SKT LTE Router SDT-CS3B1 running software version 1.2.0. The vulnerability allows unauthenticated remote attackers to trigger a device reboot by sending specially crafted HTTP POST requests to the lte.cgi endpoint. This represents a significant denial of service (DoS) risk, as attackers can repeatedly force the router to restart without requiring any credentials or prior authentication.

The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function), indicating that the affected router fails to implement proper authentication controls for the reboot functionality exposed through its web management interface.

Critical Impact

Unauthenticated attackers can cause persistent denial of service by repeatedly triggering device reboots, disrupting network connectivity for all users relying on the affected LTE router.

Affected Products

• Telesquare SKT LTE Router SDT-CS3B1
• Software Version 1.2.0
• LTE router web management interface (lte.cgi endpoint)

Discovery Timeline

• 2026-03-16 - CVE-2017-20222 published to NVD
• 2026-03-16 - Last updated in NVD database

Technical Details for CVE-2017-20222

Vulnerability Analysis

This vulnerability stems from a missing authentication check in the Telesquare SKT LTE Router's CGI-based web management interface. The router exposes a lte.cgi endpoint that processes administrative commands, including the ability to reboot the device. However, the endpoint fails to verify whether the requesting user has authenticated before executing sensitive operations.

The lack of authentication allows any network-connected attacker to issue reboot commands to the router. Since LTE routers often serve as primary internet gateways for homes and small businesses, an attacker exploiting this vulnerability can cause significant service disruption by forcing continuous device restarts.

The network-based attack vector with low complexity makes this vulnerability particularly dangerous in environments where the router's management interface is accessible from untrusted networks or the internet.

Root Cause

The root cause is the absence of authentication verification in the lte.cgi handler when processing the Command=Reboot parameter. The CGI script directly processes the reboot command without first checking session tokens, cookies, or other authentication credentials. This design flaw exposes critical device functionality to unauthenticated users.

Attack Vector

The attack is executed via the network by sending an HTTP POST request to the lte.cgi endpoint on the vulnerable router. The attacker includes the Command=Reboot parameter in the request body, which instructs the router to initiate a system restart.

The attack requires no authentication credentials, user interaction, or special privileges. An attacker only needs network access to the router's web management interface. The exploitation can be automated to persistently disrupt service by sending reboot requests in a loop as soon as the device comes back online.

For detailed technical information about this vulnerability, refer to the Zero Science Lab advisory (ZSL-2017-5444) and the Exploit-DB entry #43401.

Detection Methods for CVE-2017-20222

Indicators of Compromise

• Unexpected or frequent router reboots without administrative action
• HTTP POST requests to the /lte.cgi endpoint containing Command=Reboot parameter in access logs
• Multiple connection resets or network outages coinciding with suspicious web traffic to the router
• Unusual traffic patterns from external IP addresses targeting the router's management interface

Detection Strategies

• Monitor HTTP access logs on the router for requests to /lte.cgi with suspicious parameters
• Implement network-based intrusion detection rules to alert on POST requests containing Command=Reboot to LTE router management interfaces
• Configure SIEM alerts for patterns indicating router instability such as repeated DHCP lease requests or gateway unavailability
• Deploy network monitoring to detect unauthorized access attempts to router administrative interfaces

Monitoring Recommendations

• Enable comprehensive logging on the router's web management interface if supported
• Monitor network uptime and router availability metrics for anomalous restart patterns
• Implement alerting for any access to administrative endpoints from non-whitelisted IP addresses
• Review network traffic logs for reconnaissance activities targeting router management ports (typically 80, 443, or 8080)

How to Mitigate CVE-2017-20222

Immediate Actions Required

• Restrict access to the router's web management interface to trusted internal IP addresses only
• Place the router's management interface behind a firewall that blocks external access
• Disable remote management features if not required for operations
• Implement network segmentation to isolate router management from general network traffic
• Monitor for exploitation attempts using network intrusion detection systems

Patch Information

No vendor patch information is available in the CVE data. Organizations using affected Telesquare SKT LTE Router SDT-CS3B1 devices should contact Telesquare for updated firmware that addresses this vulnerability. Review the VulnCheck Security Advisory for any updates on remediation options.

Workarounds

• Configure network firewall rules to block external access to the router's web management interface on ports 80 and 443
• If possible, place the router behind a separate firewall appliance that can enforce authentication
• Consider replacing the vulnerable device with a router that implements proper authentication for administrative functions
• Use access control lists (ACLs) to restrict which IP addresses can reach the management interface

# Example iptables rules to restrict access to router management interface
# Apply these on an upstream firewall protecting the router

# Block external access to router management (replace ROUTER_IP with actual IP)
iptables -A FORWARD -d ROUTER_IP -p tcp --dport 80 -j DROP
iptables -A FORWARD -d ROUTER_IP -p tcp --dport 443 -j DROP

# Allow only trusted management workstation (replace ADMIN_IP with trusted IP)
iptables -I FORWARD -s ADMIN_IP -d ROUTER_IP -p tcp --dport 80 -j ACCEPT
iptables -I FORWARD -s ADMIN_IP -d ROUTER_IP -p tcp --dport 443 -j ACCEPT