Is there a patch available for CVE-2026-15485?

Yes, a patch is available for CVE-2026-15485. Update the affected software to the latest version immediately.

TRENDnet TEW-821DAP CVE-2026-15485

Q: What is the CVSS score of CVE-2026-15485?

CVE-2026-15485 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-43207 MEDIUM

OS Command Injection (CWE-78)

2026-07-12 VulDB

GHSA-xc6j-94q8-rmwc

Command Injection Tew 821Dap Trendnet

5.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

OS command injection on embedded Linux yields full device control; AV:N and PR:L reflect authenticated web admin access; scope change to underlying OS justifies S:C and H/H/H impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 12, 2026 - 07:58 vuln.today

DescriptionCVE.org

A flaw has been found in TRENDnet TEW-821DAP 1.11B03. The impacted element is the function sub_43F2C4 of the file /goform/tools_nslookup of the component DNS Lookup Handler. This manipulation of the argument nslookup_target/dns_server causes os command injection. The attack can be initiated remotely. The vendor explains: "We are unable to confirm the existence of the vulnerabilities for (...) TEW-821DAP (v1.0R) as these items have been EOL. " This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

OS command injection in the TRENDnet TEW-821DAP 1.11B03 wireless access point allows authenticated remote attackers to execute arbitrary operating system commands by manipulating the nslookup_target or dns_server arguments passed to the DNS Lookup Handler at /goform/tools_nslookup (function sub_43F2C4). The affected device is end-of-life and the vendor has explicitly declined to patch it, stating they cannot confirm the vulnerability's existence for the TEW-821DAP v1.0R. No public exploit code or CISA KEV listing has been identified at time of analysis, though the network-accessible attack surface and EOL status make remediation by replacement the only viable long-term strategy.

Technical ContextAI

CWE-78 (Improper Neutralization of Special Elements used in an OS Command) describes the root cause: user-supplied input to the nslookup_target and dns_server parameters is passed to a system shell call within function sub_43F2C4 without adequate sanitization or escaping. The vulnerable endpoint /goform/tools_nslookup is part of the device's web-based administration interface and implements a diagnostic DNS lookup tool. The CPE cpe:2.3:a:trendnet:tew-821dap:*:*:*:*:*:*:*:* covers all firmware versions of the TEW-821DAP, with the specific disclosure targeting firmware 1.11B03. The underlying firmware appears to be an embedded Linux system typical of consumer wireless access points, where CGI-style form handlers (goform) execute system utilities directly - a common pattern in network device firmware that historically yields command injection when input validation is absent.

RemediationAI

No official vendor-released patch exists for this EOL product; TRENDnet has explicitly declined to address this vulnerability. The primary remediation is device replacement with a supported TRENDnet or alternative access point model. As an immediate compensating control, restrict access to the device's web administration interface exclusively to trusted management VLANs or hosts using firewall ACLs, preventing unauthenticated or broadly-accessible network paths to the admin interface - this directly addresses the network attack vector. Disabling the DNS Lookup diagnostic tool within the admin interface, if the firmware permits, would eliminate the vulnerable endpoint entirely. Changing all admin credentials from defaults and ensuring the management interface is not exposed to untrusted networks are essential minimum controls. The patch reference (https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Trendnet/TEW-821DAP_CI3.md) is a third-party community resource, not an official vendor release; applying community firmware carries its own integrity and support risks and should be evaluated carefully.