TRENDnet TEW-635BRM CVE-2026-15481

Exploitation requires the device to be a TRENDnet TEW-635BRM (firmware ≤1.00.03) and requires the attacker to reach and submit the IPoA WAN Connection Setup, injecting into the ipoa_ipaddr argument that ipoa_test in /sbin/rc processes. The CVSS vector specifies PR:L, so authenticated/low-privilege access to the router's management interface is needed - this is the key limiting factor, meaning it is not an unauthenticated drive-by. Practical exploitation further depends on the management interface being reachable by the attacker (LAN access, or a non-default configuration exposing admin/remote management to the WAN); no user interaction is required (UI:N) and attack complexity is low (AC:L). Because it targets the legacy IPoA WAN mode, environments not using that connection type may not exercise the exact code path in normal operation, though the handler resides in the firmware regardless.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 7.4) indicates a network-reachable, low-complexity attack requiring some privilege (PR:L) that fully compromises the device's confidentiality, integrity, and availability, with E:P (Proof-of-Concept) maturity matching the reported public exploit. This is a genuine takeover-class bug, not a paper high-severity issue: PR:L most plausibly means an authenticated web-admin session, so the practical prerequisite is access to the management interface. Several factors lower real-world priority: the product is EOL since 2011, there is no CISA KEV entry, no EPSS score was provided, and the primary intelligence source is a single reporter (VulDB). The management interface should not be internet-exposed by default, so AV:N realistically applies to LAN-adjacent or explicitly-exposed-admin scenarios. Net: high technical impact constrained by required authentication and a small, aging install base - a targeted rather than mass-exploitation risk.

An attacker who can reach the router's administration interface - on the LAN, or on a unit whose remote management is exposed - authenticates (or uses default/weak credentials) and submits the IPoA WAN configuration form with a crafted ipoa_ipaddr value containing shell metacharacters. When /sbin/rc's ipoa_test processes the field, the injected commands execute with the router's privileges, giving a foothold to intercept traffic, rewrite DNS/firewall rules, or pivot into the internal network. Public exploit documentation for this exact parameter exists, lowering the skill required.