Product Security
TDI Security Bulletin
Security advisories published by the Tdintelligence Product Security Incident Response Team (PSIRT).
Advisories
TDI-SEC-2025-001
TitleSecurity Updates and Vulnerability Mitigation for TD2000G3 Device Series
Release DateOctober 22, 2025
Last UpdatedOctober 27, 2025
SeverityCritical
Affected ProductsTD2000G3 Series – All firmware versions prior to TD2000G3_1.1.46_1.2.168_1.1.85P
Fixed in VersionTD2000G3_1.1.46_1.2.168_1.1.85P (Released September 26, 2025)
- Summary
All critical and high-risk issues have been addressed in the latest firmware version TD2000G3_1.1.46_1.2.168_1.1.85P.
TDI strongly recommends all customers to upgrade immediately to the latest firmware to ensure continued secure operation and compliance with corporate and regulatory security requirements.
- Core Components Update Summary
| Component | Detected Version | Risk Summary | Known CVEs | Remediation Plan |
| nginx | 1.12.2 | Outdated (2017) | CVE-2019-20372, CVE-2018-16843 | Updated to 1.28.0 |
| Dropbear SSH | 2019.78 | Outdated | CVE-2020-36254 | Updated to 1.36.1 |
| BusyBox | 1.27.2 | Legacy (2017) | Multiple CVEs | Updated to v2025.87 |
- Firmware Update Summary
| Port | Protocol | Service | Description | New Firmware update summary |
| 22 | TCP | SSH (Dropbear) | Full root access with password authentication | Users can now enable/disable SSH; ADB disabled by default |
| 554 | TCP | RTSP | Unprotected video streams; privacy exposure | RTSP now requires username/password and can be disabled |
| 443 | TCP | HTTPS (nginx) | Self-signed certificate; not trusted | User-managed SSL certificates now supported |
| 5555 | TCP | ADB | Unauthenticated remote debug access | Disabled permanently in production firmware |
| 80 | TCP | HTTP | Unencrypted Web UI | Optional disablement via admin interface |
- Contact Information
For technical assistance or vulnerability reporting, please contact:
Email: psirt@tdintelligence.com
TDI-SEC-2026-001
Details of this advisory will be published upon release.