CVE-2026-5353 is an OS command injection vulnerability in the ping_test function of the /setup.cgi file on the Trendnet TEW-657BRM router version 1.00.1. The vulnerability allows remote attackers to manipulate the c4_IPAddr argument to execute arbitrary OS commands. The product has been discontinued and reached end-of-life in June 2011, with no vendor support or patches available. The exploit code is publicly available, but no known exploits in the wild have been reported. The CVSS 4.0 base score is 5.3, indicating a medium severity level.
CVE-2026-5352 is a medium severity OS command injection vulnerability in the Trendnet TEW-657BRM router version 1.00.1. It affects the Edit function of the /setup.cgi file via manipulation of the pcdb_list argument, allowing remote attackers to execute OS commands. The product has been discontinued and reached end-of-life in June 2011, with no vendor support or patches available. The vulnerability has been publicly disclosed but no known exploits are reported in the wild.
A weakness has been identified in Trendnet TEW-657BRM 1.00.1. This affects the function add_wps_client of the file /setup.cgi. This manipulation of the argument wl_enrolee_pin causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor confirms, that "[t]he product in question (...) has been discontinued and end of life since June 23, 2011, that is more than 14 years ago. We no longer provide support for this product, so we are not able to confirm the vulnerabilities. We will make an announcement on our website's product support page and notify customers who registered their products with us." This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2026-5350 is a high-severity stack-based buffer overflow vulnerability in the Trendnet TEW-657BRM router firmware version 1.00.1. The flaw exists in the update_pcdb function within /setup.cgi, where improper handling of the mac_pc_dba argument allows remote attackers to trigger a buffer overflow. The product has been discontinued and reached end-of-life in 2011, and the vendor no longer provides support or patches for this device. Although the exploit code is publicly available, no official fix or mitigation is provided by the vendor due to the product's unsupported status.
CVE-2026-5349 is a high-severity stack-based buffer overflow vulnerability in the Trendnet TEW-657BRM router version 1.00.1. The flaw exists in the add_apcdb function within the /setup.cgi file, where manipulation of the mac_pc_dba argument can trigger the overflow. This vulnerability can be exploited remotely without user interaction and has a publicly available exploit. However, the affected product has been discontinued and reached end-of-life in June 2011, with no vendor support or patches available. The vendor has stated they cannot confirm or fix the vulnerability but will notify registered customers via their website. No known exploits are currently observed in the wild.
CVE-2026-5184 is a medium severity command injection vulnerability affecting TRENDnet TEW-713RE version 1.02. The vulnerability exists in an unspecified function within the /goform/setSysAdm file, where manipulation of the admuser argument allows remote command injection. The exploit code is publicly available, but there is no evidence of exploitation in the wild. The vendor has not responded to disclosure attempts and no patch or official fix is currently available.
A vulnerability was determined in TRENDnet TEW-713RE up to 1.02. The affected element is the function sub_421494 of the file /goform/addRouting. Executing a manipulation of the argument dest can lead to command injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-4354 is a medium severity cross-site scripting (XSS) vulnerability affecting the web interface of TRENDnet TEW-824DRU routers, specifically versions 1.010B01 and 1.04B01. The vulnerability arises from improper sanitization of the 'Language' parameter in the apply_sec.cgi script, allowing remote attackers to inject malicious scripts. Exploitation does not require authentication but does require user interaction, such as visiting a crafted URL. Although the vendor has not responded to disclosure, no patches are currently available, and public exploits exist. This vulnerability could enable attackers to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking or phishing attacks. Organizations using these router models should be aware of the risk and implement mitigations promptly.
CVE-2026-4172 is a high-severity stack-based buffer overflow vulnerability in the TRENDnet TEW-632BRP router, specifically in the /ping_response.cgi HTTP POST request handler. The flaw arises from improper handling of the ping_ipaddr argument, allowing remote attackers to overflow the stack. Exploitation requires no user interaction but does require high privileges, and the vulnerability impacts confidentiality, integrity, and availability. Although the vendor has not responded or issued a patch, a public exploit is available, increasing the risk of attack. No known exploits in the wild have been reported yet. Organizations using this router version are at risk of remote code execution or denial of service. Immediate mitigation steps are critical to reduce exposure. Countries with significant TRENDnet market presence and strategic network infrastructure reliance are most at risk.
A flaw has been found in TRENDnet TEW-811DRU 1.0.2.0. This affects the function setDeviceURL of the file uapply.cgi of the component httpd . This manipulation of the argument DeviceURL causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was detected in TRENDnet TEW-713RE 1.02. The impacted element is an unknown function of the file /goformX/formFSrvX. The manipulation of the argument SZCMD results in os command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor confirms: "The product in question TEW-731RE for CVE-2025-15471 has been discontinued and end of life since October 23, 2020. We no longer provide support for this product, so we are not able to confirm the vulnerabilities. We will make an announcement on the website product support page and notify customers who registered their products with us." This vulnerability only affects products that are no longer supported by the maintainer.
A vulnerability has been found in TRENDnet TEW-822DRE 1.00B21/1.01B06. This affects the function sub_43ACF4 of the file /boafrm/formWsc. Such manipulation of the argument peerPin leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was detected in TRENDnet TEW-800MB 1.0.1.0. Affected by this vulnerability is the function sub_F934 of the file NTPSyncWithHost.cgi. The manipulation results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A security vulnerability has been detected in TRENDnet TEW-800MB 1.0.1.0. Affected is the function do_setWizard_asp of the file /goform/wizardset of the component Management Interface. The manipulation of the argument WizardConfigured leads to command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability has been found in TRENDnet TEW-831DR 1.0 (601.130.1.1410). Impacted is an unknown function of the file /boafrm/formSysCmd. The manipulation of the argument sysHost leads to command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was found in TRENDnet TN-200 1.02b02. It has been declared as problematic. This vulnerability affects unknown code of the component Lighttpd. The manipulation of the argument secdownload.secret with the input neV3rUseMe leads to use of hard-coded cryptographic key
. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was found in TRENDnet TEW-822DRE FW103B02. It has been classified as problematic. This affects an unknown part of the component vsftpd. The manipulation leads to least privilege violation. Attacking locally is a requirement. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was found in TRENDnet TV-IP110WN 1.2.2 and classified as problematic. Affected by this issue is some unknown functionality of the file /server/boa.conf of the component Embedded Boa Web Server. The manipulation leads to least privilege violation. Local access is required to approach this attack. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was identified in TRENDnet TI-G160i, TI-PG102i and TPL-430AP up to 20250724. This affects an unknown part of the component SSH Service. The manipulation leads to use of default credentials. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor explains: "For product TI-PG102i and TI-G160i, by default, the product's remote management options are all disabled. The root account is for troubleshooting purpose and the password is encrypted. However, we will remove the root account from the next firmware release. For product TPL-430AP, the initial setup process requires user to set the password for the management GUI. Once that was done, the default password will be invalid."
A vulnerability has been found in TRENDnet TV-IP121W 1.1.1 Build 36 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/setup.cgi of the component Web Interface. The manipulation leads to improper authentication. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.