TEW-813DRU CVE-2026-19841

Q: What is the CVSS score of CVE-2026-19841?

CVE-2026-19841 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-58718 LOW

Incorrect Default Permissions (CWE-276)

2026-08-14 VulDB

GHSA-q9qq-j7ff-cpp6

Privilege Escalation Tew 813Dru Trendnet

2.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.1 LOW

Network-accessible vsftpd requires low-privilege auth; high complexity per description; only integrity write impact on device config, no C or A.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 17:20 vuln.today

DescriptionCVE.org

A flaw has been found in TRENDNET TEW-813DRU 1.01b01. Impacted is an unknown function of the file /etc/vsftpd.conf of the component vsftpd. This manipulation causes incorrect default permissions. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is considered difficult. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Incorrect default file permissions on /etc/vsftpd.conf in TrendNet TEW-813DRU firmware 1.01b01 allow a remote low-privileged attacker to manipulate FTP server configuration, resulting in low-severity integrity compromise. The affected product is end-of-life and will receive no vendor patch. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 2.3 reflects the high attack complexity and minimal impact scope.

Technical ContextAI

The TrendNet TEW-813DRU is a SOHO wireless router running firmware version 1.01b01. The affected component is vsftpd (Very Secure FTP Daemon), a common Linux FTP server, whose configuration file /etc/vsftpd.conf is exposed with incorrect default permissions (CWE-276). CWE-276 occurs when files or directories are created or shipped with permissions that grant access beyond what the application's security model intends - in this case, allowing a low-privileged user to read or write a system configuration file that should be owner/root-restricted. The CPE cpe:2.3:a:trendnet:tew-813dru:*:*:*:*:*:*:*:* identifies the TrendNet TEW-813DRU across all sub-versions. Since the device is end-of-life, the firmware's permission model will not be corrected by the maintainer.

RemediationAI

No vendor-released patch is available, and none is expected given the product's end-of-life status. The primary mitigation is device replacement with a currently supported router model. If replacement is not immediately feasible, disable remote FTP access to the device by blocking TCP port 21 at the network perimeter or on upstream firewall rules - this directly reduces the network attack surface for this vulnerability, though it may disrupt any FTP-based administration workflows. Additionally, restrict management network access to trusted IP ranges only, reducing the pool of principals who could leverage low-privileged FTP credentials. Correcting the file permission on /etc/vsftpd.conf to 640 or 600 (owner root, no world-read/write) via firmware modification would address the root cause, but this requires custom firmware capabilities not available to typical end users. VulDB submission reference: https://vuldb.com/submit/870586.