TRENDnet TEW-755AP CVE-2026-76591

The attacker must possess valid credentials granting at least low-level access to the TEW-755AP web management interface - confirmed by the CVSS 4.0 PR:L metric. The vulnerable code path is reached only when an HTTP request is submitted to /cgi-bin/email.cgi, meaning the email/logging configuration feature must be reachable from the attacker's network position (AV:N confirms the management interface is network-accessible). No special non-default configuration of the email feature itself is required beyond having access to submit the form. Exploitation is limited by the credential requirement (PR:L): pure unauthenticated exploitation is not supported by available data. Default or weak credentials on TRENDnet devices materially reduce this barrier in practice. The attack does not require user interaction (UI:N) and is low-complexity (AC:L/AT:N), meaning exploitation is straightforward once credentials are obtained.

The provided CVSS 4.0 vector scores this at 2.1 with all vulnerable-system impacts rated Low (VC:L/VI:L/VA:L), which significantly understates the typical impact of successful command injection on an embedded networking device. An independent assessment (see assessed_cvss_vector) places this at high severity due to the near-universal root-level execution context of CGI handlers on such devices. The E:P supplemental metric acknowledges publicly available exploit code, which materially elevates real-world risk above the base score. PR:L indicates low-privilege credentials are required, meaning unauthenticated exploitation is not supported by the CVSS data; however, consumer and SMB routers/APs frequently use weak or default credentials, reducing the effective barrier. EPSS data was not supplied; exploit availability with a working POC Python script on GitHub suggests non-trivial exploitation probability. No CISA KEV listing is present, and no indication of widespread active exploitation was found. The primary real-world risk is targeted exploitation of internet-exposed management interfaces or lateral movement within networks where attacker credentials are already compromised.

An attacker with low-privilege credentials to the TEW-755AP web interface (e.g., obtained via default credentials or credential stuffing) sends an HTTP POST request to /cgi-bin/email.cgi with shell metacharacters injected into the email server parameter - for example, appending ; id > /tmp/pwned or a reverse-shell payload. The log_email_server function passes this value unsanitized into a system call, executing the injected commands under the CGI process's OS user context (typically root on embedded devices). The publicly available POC at https://github.com/meishigana/CVE/blob/main/team15_20260702/14_755ap-ssi-cmdi/poc/poc-ssi-injection.py automates this sequence.