TRENDnet TEW-800MB CVE-2025-15137

Exploitation targets the NTPSyncWithHost.cgi endpoint (NTP sync-with-host feature) on TRENDnet TEW-800MB firmware 1.0.1.0, injecting OS commands through input handled by the sub_F934 function. The CVSS vector requires PR:L, so a valid low-privilege account (or an authenticated/management session to the router's web interface) is needed - it is not fully unauthenticated. Limiting factors: exploitation presupposes network reachability of the device's management interface (typically LAN-side on consumer routers unless remote management is enabled) and a working credential or session; the flaw is confined to this one firmware version/model, bounding the exposed population.

Signals are moderately consistent and point to a real-but-not-top-tier priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a remotely reachable, low-complexity command injection requiring only low-level authentication (PR:L) and no user interaction, with high impact to confidentiality, integrity and availability of the device itself (VC:H/VI:H/VA:H) and no subsequent-system scope (SC:N/SI:N/SA:N) - consistent with full compromise of a single SOHO router. A public exploit/PoC exists (vendor-hosted write-up on Notion and VulDB entry 338515), which raises practical exploitability, but this is distinct from active exploitation: there is NO CISA KEV listing and NO EPSS score provided, so widespread opportunistic exploitation is unconfirmed. The reporting path (cna@vuldb.com, VulDB) and the vendor's non-response mean there is no official patch or advisory, increasing residual risk for exposed devices. Net: a credible, publicly-exploitable authenticated command injection on a niche consumer device - prioritize for anyone running this specific model with management exposed, but it is not a mass-internet emergency on the evidence available. Key missing data explicitly noted: no EPSS probability and no KEV status were supplied, so likelihood-of-exploitation cannot be quantified.

An attacker with valid low-privilege credentials (or on a network where the router's web UI is reachable) sends a crafted request to NTPSyncWithHost.cgi, injecting shell metacharacters into a parameter processed by sub_F934, causing arbitrary OS commands to run on the router. A public PoC exists (VulDB 338515 and a vendor-hosted Notion write-up), lowering the skill barrier. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, exploitation is remote, low-complexity and needs no user interaction once minimal authentication is satisfied.