A cross‑site request forgery flaw in the Telesquare SKT LTE Router SDT‑CS3B1 exposes authenticated users to arbitrary system command execution. The absence of request validation allows a malicious website to trigger administrative actions on the router, giving the attacker full control of the device. The vulnerability is classified as CWE‑352 and can lead to complete compromise of the router’s operating system, enabling data exfiltration, service disruption, or further lateral movement into the network.

The flaw exists in the Telesquare SDT‑CS3B1 router, particularly firmware versions 1.1.0 and 1.2.0. Users of these routers running the affected firmware are vulnerable if they have administrative access to the web interface.

The CVSS score of 5.3 indicates a medium severity vulnerability. With an EPSS score of less than 1% the probability of active exploitation is low, and the flaw is not listed in the CISA KEV catalog. The attack requires an authenticated user who visits a crafted malicious page; therefore exploitation relies on social‑engineering or phishing of a legitimate user rather than remote autonomous code execution.