TRENDnet TEW-800MB CVE-2025-15136

Requires an authenticated low-privilege session to the device's web Management Interface, then a crafted request to /goform/wizardset reaching the do_setWizard_asp function with a malicious WizardConfigured argument (CWE-74 command injection). Exploitation is network-based and needs no user interaction, but is limited by: the authentication requirement (CVSS PR:L - valid credentials or default/weak creds are needed), reachability of the management interface (sharply higher risk if WAN-side remote management is enabled, otherwise LAN-only), and the specific affected build TEW-800MB firmware 1.0.1.0.

This is a genuine but bounded risk. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 7.4 (High) and describes a network-reachable, low-complexity command injection with full confidentiality/integrity/availability impact to the device, but critically requires PR:L - low-level authentication - so it is NOT an unauthenticated flaw. Publicly available exploit code exists (confirmed by the NVD 'exploit' reference to a Notion writeup), and the CVSS 4.0 exploit-maturity metric E:P (Proof-of-Concept) is consistent with that. However, there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active, widespread exploitation - the signals indicate a disclosed PoC against a specific consumer router model rather than mass exploitation. The authentication requirement (PR:L) is the single biggest risk-limiter and separates this from a critical wormable issue; the practical danger rises sharply if the device exposes its management interface to the internet or uses default/weak credentials. Net: a real priority for anyone running this exact device with remote management enabled, but lower urgency than the raw High score suggests for hardened deployments. Note the vendor was contacted but did not respond, so no official patch or advisory exists to corroborate affected-version boundaries beyond the NVD CPE.

An attacker with low-privilege credentials (or access to a device with default/weak credentials) reaches the web management interface over the network and sends a crafted request to /goform/wizardset, injecting OS commands via the WizardConfigured parameter handled by do_setWizard_asp. Because a public proof-of-concept exists, the injected commands execute on the router with device privileges, giving the attacker control over the appliance. Attack complexity is low (AC:L) and no user interaction is needed, but valid authentication (PR:L) is a prerequisite.