TRENDnet TEW-824DRU CVE-2026-4354

The CVSS v3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) yields a score of 3.5, indicating low severity due to three mitigating factors: authentication requirement (PR:L), user interaction dependency (UI:R), and impact limited to integrity only (no confidentiality or availability loss). However, real-world risk must be contextualized: the public POC availability significantly increases exploitation likelihood; the router administrative interface is a high-value target despite authentication; and the authentication requirement is often weak on home/small-business routers (default credentials are common). The attack vector is network-accessible, which is concerning for internet-facing routers. While the CVSS score appears low, the combination of public exploit code, no vendor response, and the nature of the target (network appliance with default/weak credentials) elevates practical risk beyond the numerical score. An attacker with valid credentials (or using default credentials) can deface the router configuration interface or perform phishing attacks against administrators, making this a legitimate priority despite the low CVSS.

An attacker with valid credentials (obtained through credential stuffing, social engineering, or default credentials) logs into the TRENDnet router's web interface and crafts a malicious URL containing JavaScript payload in the Language parameter (e.g., applying a language setting that includes script tags). This URL is sent to another administrator. When the victim clicks the link or if the attacker uses the public POC to automate delivery, the injected JavaScript executes in the victim's browser with the same privileges as the authenticated session, allowing the attacker to modify router settings, steal session tokens, or redirect the administrator to a phishing site. The low complexity and network accessibility make this practical despite the authentication requirement.