Which versions of TRENDnet TEW-635BRM are affected by CVE-2026-15481?

The legacy TRENDnet TEW-635BRM router (unsupported since 2011) is vulnerable to authenticated command injection that grants full system compromise, directly threatening the security posture of any…

Is there a public PoC exploit available for CVE-2026-15481?

Yes, a public proof-of-concept exploit is available for CVE-2026-15481. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-15481?

24 hours: Inventory all TRENDnet TEW-635BRM routers in production and immediately restrict administrative access; disable remote management if enabled. 7 days: Isolate vulnerable devices to segregated network segments with no internet-facing access, or begin removal from production. 30 days: Complete replacement of all affected units with current-generation routers receiving active security updates; fully decommission all TEW-635BRM equipment.

TRENDnet TEW-635BRM CVE-2026-15481

Q: What is the CVSS score of CVE-2026-15481?

CVE-2026-15481 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-43203 HIGH

Command Injection (CWE-77)

2026-07-12 VulDB

GHSA-wq7g-mf6c-75vq

Command Injection Tew 635Brm Trendnet

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable admin interface with low-complexity injection requiring an authenticated low-privilege session (PR:L); root-level command execution yields full C/I/A impact with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 12, 2026 - 06:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 12, 2026 - 06:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 12, 2026 - 06:22 vuln.today

cvss_changed

CVSS changed

Jul 12, 2026 - 06:22 NVD

8.7 (HIGH) 7.4 (HIGH)

Analysis Generated

Jul 12, 2026 - 06:20 vuln.today

DescriptionCVE.org

A security flaw has been discovered in Trendnet TEW-635BRM up to 1.00.03. This vulnerability affects the function ipoa_test of the file /sbin/rc of the component IPoA WAN Connection Setup. Performing a manipulation of the argument ipoa_ipaddr results in command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor explains: "We are unable to confirm if the vulnerability exists. This item has been EOL since 2011. We will make an official announcement of possible vulnerabilities, and recommend users to switch devices." This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Command injection in the TRENDnet TEW-635BRM wireless router (firmware through 1.00.03) lets an authenticated remote attacker inject OS commands via the ipoa_ipaddr argument handled by the ipoa_test function in /sbin/rc during IPoA WAN connection setup. Publicly available exploit code exists (published via VulDB and a researcher write-up), and because the device runs its control logic as a privileged system process, successful injection yields full command execution on the router. The product has been end-of-life since 2011 and the vendor will not issue a fix, so exposure is permanent for still-deployed units; there is no CISA KEV listing or confirmation of active exploitation.

Technical ContextAI

The TEW-635BRM is a consumer/SOHO wireless broadband router. The affected code path lives in /sbin/rc, a shell/init control script invoked to configure the WAN interface in IPoA (IP over ATM) mode - a legacy DSL/ATM WAN connectivity option. The ipoa_test function consumes the user-supplied ipoa_ipaddr value and passes it into a shell context without adequate sanitization, matching CWE-77 (Improper Neutralization of Special Elements used in a Command). Because embedded router init scripts typically execute as root, shell metacharacters (e.g. ; | ` $()) placed in the IP address field are interpreted as commands. The single CPE, cpe:2.3:a:trendnet:tew-635brm:*:*:*:*:*:*:*:*, confirms scope is limited to this one product line, with the version bound '<=1.00.03' expressed only in the description.

RemediationAI

No vendor-released patch identified at time of analysis - the device is EOL since 2011 and TRENDnet has stated it will not confirm or fix the issue, recommending users replace the hardware, so the primary remediation is device replacement with a currently supported router. As compensating controls for units that must remain in service: ensure the web/management interface is never exposed to the WAN/Internet by blocking inbound access to the admin HTTP port at the upstream firewall, removing the external network vector; restrict LAN-side management to a trusted admin VLAN or specific host to limit who can reach the IPoA setup form; change default administrator credentials and disable remote management, since exploitation needs the authenticated access implied by PR:L; and avoid using the IPoA WAN connection mode where an alternative WAN type is available. The trade-off is that these controls do not remove the vulnerable code - any admin-authenticated user on the permitted management path can still trigger it - so they reduce but do not eliminate risk. Monitor the VulDB entry (https://vuldb.com/vuln/377788) for updates.