Threats affecting pkg:github/panda666-888/tew-657brm

CVE-2026-5352 is a medium severity OS command injection vulnerability in the Trendnet TEW-657BRM router version 1.00.1. It affects the Edit function of the /setup.cgi file via manipulation of the pcdb_list argument, allowing remote attackers to execute OS commands. The product has been discontinued and reached end-of-life in June 2011, with no vendor support or patches available. The vulnerability has been publicly disclosed but no known exploits are reported in the wild.

CVE-2026-5349 is a high-severity stack-based buffer overflow vulnerability in the Trendnet TEW-657BRM router version 1.00.1. The flaw exists in the add_apcdb function within the /setup.cgi file, where manipulation of the mac_pc_dba argument can trigger the overflow. This vulnerability can be exploited remotely without user interaction and has a publicly available exploit. However, the affected product has been discontinued and reached end-of-life in June 2011, with no vendor support or patches available. The vendor has stated they cannot confirm or fix the vulnerability but will notify registered customers via their website. No known exploits are currently observed in the wild.