CVE-2026-108804: OS Command Injection in TRENDnet TEW-751DR

This vulnerability involves OS command injection in the fwrite function of the pigwidgeon.cgi component of the Web Management Backend on TRENDnet TEW-751DR, TEW-752DRU, and TEW733GR routers with firmware versions 1.03B01 and 1.03B03. By manipulating the 'service' argument, an attacker can remotely execute arbitrary operating system commands. The vendor has confirmed the product is end-of-life since 2011 and does not provide patches or testing for this vulnerability. The exploit code is publicly available, increasing the risk of exploitation.

Successful exploitation allows remote attackers to execute arbitrary OS commands on affected devices without any authentication, leading to full compromise of the device. Given the critical CVSS score of 10.0 and the remote, unauthenticated nature of the vulnerability, impacted devices are at high risk of takeover, potentially affecting network security and device integrity.

No official patch or fix is available as the affected products have been end-of-life since 2011 and are no longer supported by TRENDnet. Users should consider replacing affected devices with supported models to mitigate risk. The vendor has notified customers about the potential vulnerability but does not provide remediation. Patch status is not yet confirmed due to lack of vendor support; check vendor communications for any updates.