TRENDnet TEW-713RE
CVE-2025-15471
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device web interface on network
-
DeliverySend crafted request to /goformX/formFSrvX
-
ExploitInject shell metacharacters via SZCMD argument
-
ExecutionFirmware executes injected OS command
-
ImpactFull command execution / device takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the TEW-713RE (firmware 1.0.2) HTTP management interface and the ability to send a request to /goformX/formFSrvX with an attacker-controlled SZCMD parameter. No authentication, no user interaction, and no non-default configuration are needed (PR:N/UI:N), so any attacker who can reach the web interface can exploit it. The practical limiting factor is exposure: on a consumer range extender the admin interface is typically bound to the LAN/Wi-Fi side, so remote internet exploitation depends on the interface being exposed via remote management, port forwarding, or an attacker already on the local network. |
| Impact | This is a genuine high-priority issue for any exposed device, not a paper-tiger high score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes unauthenticated, low-complexity, remote OS command injection yielding full compromise of the device - the most dangerous class of flaw. Corroborating signals align: a public exploit exists (E:P, and the NVD reference is explicitly tagged 'exploit'), and EPSS of 1.23% at the 79th percentile is elevated relative to the CVE population, consistent with a public PoC against a network device. There is no CISA KEV listing and no evidence of active exploitation, so this is 'publicly available exploit code exists' rather than confirmed in-the-wild abuse. The main mitigating factor is exposure, not exploitability: TEW-713RE is a consumer Wi-Fi range extender whose management interface is normally LAN-facing, so mass internet-wide exploitation is limited unless the web interface is reachable remotely. The vendor did not respond to disclosure and no patch is referenced, so affected instances are effectively unremediated. Net: real, weaponizable priority wherever the device's HTTP interface is reachable by an attacker. |
| Exploit ScenarioDerived | An attacker with network access to the extender's web interface sends a crafted HTTP request to /goformX/formFSrvX with a malicious SZCMD parameter, injecting shell metacharacters that the firmware passes to an OS command. Because no authentication or user interaction is required, this yields arbitrary command execution on the device with the privileges of the web server (typically root on such SOHO firmware). A public exploit/PoC is already available, lowering the skill barrier to reuse. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Sep 30, 2026
OS command injection in TRENDnet TEW-713RE firmware 1.0.2 allows unauthenticated remote attackers who can reach the device's HTTP management interface to execute arbitrary OS commands via a crafted SZCMD parameter sent to /goformX/formFSrvX. The issue is CWE-77 and publicly available exploit code exists, with the provided CVSS 4.0 base score of 8.9 and EPSS 1.23% (79th percentile). The practical exposure risk depends on whether the admin interface is reachable from untrusted networks, since the extender's management UI is typically LAN/Wi-Fi bound and internet exploitation requires remote management, port forwarding, or an on-LAN foothold.
Earlier versions of this analysis (2)
Unauthenticated OS command injection in TRENDnet TEW-713RE firmware 1.0.2 lets remote attackers execute arbitrary shell commands on the device by sending a crafted request to the /goformX/formFSrvX endpoint with a malicious SZCMD argument. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), no credentials and no user interaction are required, so any reachable management interface on a default 1.0.2 deployment is exploitable, giving full compromise of confidentiality, integrity, and availability. Publicly available exploit code exists (a working proof-of-concept is published) and EPSS rates the flaw at 1.23% (79th percentile), indicating elevated, though not yet mass-observed, exploitation likelihood; there is no CISA KEV listing, so confirmed active exploitation has not been established. The vendor was contacted but did not respond, and no vendor-released patch has been identified.
TRENDnet TEW-713RE allows unauthenticated command injection via the SZCMD parameter, with a public exploit and no vendor response.
RemediationAI
No vendor-released patch identified at time of analysis; TRENDnet was contacted about the disclosure but did not respond, and no fixed firmware version is provided in the available references. Because publicly available exploit code exists and exploitation requires reaching the HTTP management endpoint, immediate compensating controls are to remove WAN exposure of the device's admin interface by disabling remote management and deleting any port-forwarding or DMZ rules, and to place the extender on an isolated or untrusted VLAN; the trade-off is loss of remote administration and possible disruption of normal extender bridging if segmentation is too restrictive. If the device cannot be isolated, restrict access to /goformX/formFSrvX and the management port to trusted admin IPs via an upstream firewall or access-control rules and monitor for anomalous requests, understanding that this may not fully prevent an attacker already on the permitted LAN/Wi-Fi segment. Consider replacing the TEW-713RE with a supported device if the risk is unacceptable, and track VULDB advisories (https://vuldb.com/?id.339721) for any future vendor fix; the public exploit write-up is at https://pentagonal-time-3a7.notion.site/Command-Injection-Vulnerability-in-formFSrvX-of-Trendnet-TEW-713RE-2d1e5dd4c5a5801481abe7a944763d39.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is TRENDnet TEW-713RE firmware 1.0.2, identified by CPE cpe:2.3:o:trendnet:tew-713re_firmware:1.0.2:*:*:*:*:*:*:*. The vulnerability is CWE-77, improper neutralization of special elements used in a command, meaning the web handler at /goformX/formFSrvX fails to sanitize the SZCMD argument before passing it to a shell or command execution API. This is an embedded device HTTP management endpoint, so successful exploitation can yield command execution with the privileges of the web service and affect confidentiality, integrity, and availability. The independent assessment confirms a network attack vector with no authentication or user interaction required (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); the provided CVSS 4.0 vector also has PR:N/UI:N and E:P, consistent with public exploitability. Exploitation requires network reachability to the HTTP management interface, so exposure is primarily a concern when the interface is internet-facing or reachable by an attacker already on the local network.
Know when Tew 713re Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Unauthenticated remote OS command injection over the network with no user interaction grants full command execution on the device, so PR:N/UI:N/AC:L and C/I/A all High.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability was detected in TRENDnet TEW-713RE 1.02. The impacted element is an unknown function of the file /goformX/formFSrvX. The manipulation of the argument SZCMD results in os command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
TRENDnet TEW-713RE wireless extenders running firmware 1.0.2 have a high-severity security weakness that can allow an attacker with network access to the management interface to take control of the device. No vendor-released patch has been identified, and publicly available exploit code exists, so organizations using these extenders-particularly in flat or externally reachable networks-face elevated risk of device compromise and potential lateral movement into the broader environment.
No vendor-released patch identified at time of analysis; interim mitigations include restricting the management interface to trusted LAN/Wi-Fi only, disabling remote management and port forwarding, isolating TEW-713RE devices on a dedicated VLAN with no access to sensitive systems, monitoring for anomalous /goformX/formFSrvX or SZCMD activity, and replacing or retiring devices where feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
GitHub PoC
Exploit-DB