TRENDnet TEW-811DRU CVE-2025-15472

Requires an authenticated session on the TRENDnet TEW-811DRU (firmware 1.0.2.0) web administration interface (httpd), consistent with the vendor's PR:H rating - the attacker must reach the uapply.cgi endpoint and invoke setDeviceURL with an attacker-controlled DeviceURL value containing shell metacharacters. No user interaction is needed (UI:N) and the attack is network-initiated (AV:N), but exploitation is limited by: (1) the need for administrative web credentials, realistically satisfied via default/weak/reused passwords on SOHO gear; (2) network reachability of the management interface, typically LAN-side unless remote management is enabled or the device is internet-exposed; and (3) possession of this specific discontinued router model on the vulnerable firmware. No official patch is available because the vendor did not respond to disclosure.

The vendor CVSS 4.0 vector (AV:N/AC:L/PR:H/UI:N/VC:H/VI:H/VA:H, 7.3) describes a fully remote, low-complexity OS command injection yielding total confidentiality, integrity, and availability impact on the device - but gated behind PR:H, meaning an authenticated (administrative) session is required. This is the decisive limiting factor: it is not pre-auth RCE. Supporting signals are mixed-to-moderate: EPSS is 0.69% (71st percentile), which is elevated for a niche consumer router but still far below values associated with mass exploitation; a public exploit write-up exists (POC=YES), yet there is no CISA KEV listing, so the correct characterization is 'publicly available exploit code exists' - NOT active exploitation. The realistic risk is opportunistic compromise of internet-exposed or LAN-adjacent TEW-811DRU routers where default/weak/reused admin credentials let an attacker satisfy the PR:H requirement, after which the flaw hands over root-level control of the device. The vendor was contacted and did not respond, so no official patch is expected - this is effectively an unpatched, end-of-life SOHO device, which raises persistence risk even though the raw probability of being targeted is bounded by the product's small footprint. Net: a genuinely serious flaw per device, but a low-priority CVE at fleet scale unless you specifically operate this hardware.

An attacker who has authenticated to the router's web administration interface (via default, weak, guessed, or reused credentials) sends a crafted request to uapply.cgi that injects shell metacharacters into the DeviceURL argument handled by the setDeviceURL function. The command injection executes with the httpd/root privileges of the embedded web server, granting full control of the router. A public exploit write-up is available, lowering the skill needed to reproduce it.