This vulnerability in TRENDnet TEW-713RE up to version 1.02 involves command injection via the admuser parameter in the /goform/setSysAdm endpoint. An attacker can remotely send crafted input to this argument to execute arbitrary commands on the device. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity with network attack vector, low complexity, and no user interaction required. Despite public availability of exploit code, no known active exploitation has been reported. The vendor has not issued any advisory or patch for this issue.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially leading to unauthorized control or disruption of the device’s operation. Given the medium CVSS score and the nature of command injection, this could compromise device integrity and confidentiality. However, no active exploitation in the wild has been confirmed.

No official patch or fix is currently available from the vendor, who has not responded to disclosure attempts. Users should consider restricting network access to the affected device, especially to the /goform/setSysAdm endpoint, to trusted sources only. Monitor for unusual device behavior and apply any future vendor updates promptly once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.