EUVD-2026-18362
GHSA-3w99-p9rf-w2qj
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Despite a CVSS 4.0 score of 5.3, real-world risk is exceptionally low due to multiple mitigating factors. The CVSS vector indicates the attack requires authentication (PR:L), low attack complexity, and network accessibility-but the product has been end-of-life for over 14 years (discontinued June 2011) with no vendor support. The vendor explicitly confirmed discontinuation and inability to provide patches. While the EPSS score is not provided in the input data, the practical exploitation likelihood is diminished by the fact that any organization still deploying this router in 2024+ is either unaware of its obsolescence or operating in a legacy/isolated network where compromise may have limited cascading impact. The existence of publicly available exploit code (tagged as 'Exploit' in references) confirms proof-of-concept availability, but this should not elevate priority for modern environments. Organizations still using this hardware should prioritize replacement over patching. |
| Exploit ScenarioDerived | An authenticated user on the local network or someone who has obtained valid credentials to the router's web interface navigates to the setup page and manipulates the wl_enrolee_pin parameter in the add_wps_client function to inject OS commands (e.g., wl_enrolee_pin=1234; cat /etc/passwd). The unsanitized input is executed by the underlying system, allowing the attacker to read sensitive files, modify configuration, or establish persistence. The authentication barrier prevents unauthenticated remote exploitation from the internet, but credential compromise, default credentials, or local network access makes this scenario realistic in legacy environments. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 02, 2026
OS command injection in TrendNet TEW-657BRM 1.00.1 router allows authenticated remote attackers to execute arbitrary commands via manipulation of the wl_enrolee_pin parameter in the /setup.cgi add_wps_client function. The vendor discontinued this product in June 2011 and provides no support; publicly available exploit code exists but real-world risk is minimal given the product's 14+ year obsolescence and the authentication requirement.
RemediationAI
No patch is available or will be released, as confirmed by the vendor's statement regarding end-of-life status. Organizations must immediately remove affected TEW-657BRM routers from production and replace them with current, supported hardware. If temporary continued operation is unavoidable, implement network-level controls: restrict access to the /setup.cgi interface to trusted administrative IPs only via firewall rules, disable remote management features if possible, and isolate the device on a segregated management VLAN. Change default credentials immediately. Consult the vendor's product support page (https://www.trendnet.com/) for any legacy notices, though no patched firmware version will be forthcoming.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in a TrendNet wireless router's CGI-based web administration interface. The /setup.cgi script's add_wps_client function fails to properly sanitize the wl_enrolee_pin input parameter before passing it to an OS command execution context, allowing injection of arbitrary shell commands. This is a classic OS command injection vulnerability (CWE-78) where user-controlled input is concatenated into a system command without proper escaping or validation. The affected product is identified by CPE cpe:2.3:a:trendnet:tew-657brm:*:*:*:*:*:*:*:* and was a consumer/small-office wireless router from the early 2000s era.
Know when Tew 657Brm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A weakness has been identified in Trendnet TEW-657BRM 1.00.1. This affects the function add_wps_client of the file /setup.cgi. This manipulation of the argument wl_enrolee_pin causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor confirms, that "[t]he product in question (...) has been discontinued and end of life since June 23, 2011, that is more than 14 years ago. We no longer provide support for this product, so we are not able to confirm the vulnerabilities. We will make an announcement on our website's product support page and notify customers who registered their products with us." This vulnerability only affects products that are no longer supported by the maintainer.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in Trendnet TEW-657BRM Command Injection
View all 5More in Tew 657Brm
View allStack-based buffer overflow in Trendnet TEW-657BRM 1.00.1 wireless router allows authenticated remote attackers to achie
Stack-based buffer overflow in Trendnet TEW-657BRM router firmware 1.00.1 allows authenticated remote attackers to achie
Exploit-DB