TRENDnet TEW-821DAP CVE-2026-15486

Exploitation requires an authenticated session to the TRENDnet TEW-821DAP web management interface - the CVSS 4.0 vector specifies PR:L, meaning at minimum a low-privilege authenticated account is needed. The attacker must be able to reach the management interface over the network (AV:N), which is the default on LAN-side access; WAN exposure would depend on whether remote management is enabled (off by default on most consumer devices). The specific vulnerable endpoint is /goform/tools_ddns, meaning the DDNS configuration feature must be accessible within the web UI. Exploitation is constrained by: (1) requirement for valid credentials, limiting unauthenticated remote exploitation; (2) typical LAN-only management interface exposure unless WAN management is explicitly enabled; (3) EOL hardware that may already be decommissioned in many environments. No special firmware configuration beyond a functional web interface is required.

The reported CVSS 4.0 score of 5.3 (Medium) with VC:L/VI:L/VA:L appears to understate the practical impact of arbitrary OS command injection on a network gateway device. An independent assessment yields CVSS 3.1 at approximately 8.8 (High) with C:H/I:H/A:H, as command injection on router firmware typically yields full device control. Key risk factors: AV:N confirms internet-accessible attack surface if the management interface is exposed to WAN; PR:L requires authenticated access, which is a meaningful constraint on LAN-only deployments where default credentials may still be in use. EOL status is the dominant risk amplifier - no vendor-issued patch will be released, as explicitly confirmed by TRENDnet, meaning affected devices remain permanently vulnerable. The 'patch available' metadata is misleading - the reference points to a third-party IOT research repository, not an official TRENDnet firmware update. EPSS data is unavailable, and no KEV listing exists, suggesting no confirmed mass exploitation to date. The primary real-world risk is to small offices or home environments that have never replaced this EOL hardware.

An attacker with valid low-privilege credentials to the TRENDnet TEW-821DAP web management interface - obtained via credential stuffing, default factory credentials, or prior reconnaissance - submits a crafted POST request to /goform/tools_ddns embedding shell metacharacters (e.g., semicolons or backtick sequences) within the hostname, username, or password fields. The firmware's sub_42026C function passes this input unsanitized to an OS-level shell call, executing the injected command with the privileges of the web server process, typically root on embedded devices. No public exploit code has been identified, but the CWE-78 class and the published firmware analysis in the IOTRes repository provide sufficient detail for straightforward weaponization.