CVE-2021-46422

This vulnerability lets someone on the internet send special input to your device and make it run commands on its own computer. Think of it like a front door that doesn’t require a key—an attacker can tell the device to do whatever they want, including taking control. If your device is online and reachable, it’s the kind of weakness that gets devices pulled into automated attacks.

This matters if you operate or maintain a Telesquare SDT-CW3B1 device running firmware version 1.1.0 and it’s reachable over the network. It’s especially important for devices exposed to the public internet, because the flaw does not require any login or user interaction. This is a risk when attackers can reach the device’s network-facing web interface; if the device is not reachable from the internet, the risk is substantially reduced.

This is urgent because exploitation has been reported in the wild, including use by a Mirai-derived botnet reported to target internet-facing edge devices. Your exposure is straightforward: if you have the affected firmware and the device is reachable, an attacker can attempt the intrusion without needing credentials. The findings also show no known patch information, so containment may be your primary immediate step.