This vulnerability affects the Trendnet TEW-657BRM router firmware version 1.00.1. The issue lies in the ping_test function within /setup.cgi, where insufficient input validation on the c4_IPAddr parameter allows an attacker to perform OS command injection remotely. The vendor has confirmed that the product is discontinued and no longer supported, so no official fixes or patches are provided. The vulnerability was published in 2026, and while exploit code is public, there are no confirmed active exploits. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability.

Successful exploitation could allow remote attackers to execute arbitrary OS commands on the affected device, potentially leading to unauthorized control or disruption of the router. However, since the product is discontinued and unsupported for over 14 years, the impact is limited to legacy devices still in use. No known exploits in the wild have been reported.

No official patch or fix is available because the product is discontinued and end-of-life since 2011. Users are advised to replace the affected Trendnet TEW-657BRM devices with supported hardware to mitigate this vulnerability. The vendor has stated they will notify registered customers via their product support page but cannot provide direct remediation.