CVE-2026-77988: Command Injection in TRENDnet TEW-823DRU

The vulnerability CVE-2026-77988 affects TRENDnet TEW-823DRU version 1.1.02b01. It is caused by improper input handling in the nvram_get function of the CLI Configuration Tool, leading to command injection. This flaw allows remote attackers with high privileges to execute arbitrary commands on the device. The vulnerability is remotely exploitable without user interaction and has a CVSS 4.0 base score of 5.1 (medium severity). Public exploit code exists, increasing the risk of exploitation. No official patch or fix details are provided in the available data.

Successful exploitation of this vulnerability could allow an attacker with high privileges to execute arbitrary commands remotely on the affected device, potentially compromising device integrity and confidentiality. The medium CVSS score reflects moderate impact with some complexity and privileges required. Public exploit availability increases the risk of attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict remote access to the device's management interface and monitor for suspicious activity. Avoid exposing the device's CLI Configuration Tool to untrusted networks.