TRENDnet TEW-823DRU CVE-2026-77988

Exploitation requires valid administrator-level (high-privilege) credentials on the target TEW-823DRU, as confirmed by PR:H in the CVSS 4.0 vector - unauthenticated exploitation is not supported by the available data. The vulnerable nvram_get function must be reachable through the CLI Configuration Tool, which requires either local network access or that remote management is enabled on the device. Limiting factors are: (1) the attacker must possess or obtain administrative credentials before any exploitation is possible; (2) remote management must be enabled or the attacker must have network-level access to the device's management interface; (3) only firmware version 1.1.02b01 is explicitly confirmed - vulnerability of other versions is unconfirmed. There is no required user interaction beyond the attacker's own actions once credentials are in hand.

The CVSS 4.0 score of 5.1 (Medium) accurately reflects a meaningful constraint: exploitation demands high-privilege administrator credentials (PR:H), which substantially narrows the realistic attacker pool compared to unauthenticated vulnerabilities. The network attack vector (AV:N) with low complexity (AC:L) and no user interaction (UI:N) means that once credentials are in hand, exploitation is straightforward, and the public POC on GitHub lowers the technical barrier further. Impact metrics are assessed as Low across all vulnerable-system dimensions (VC:L/VI:L/VA:L) and subsequent-system dimensions (SC:L/SI:L/SA:L), consistent with a SOHO router whose primary risk is device takeover rather than sensitive data exposure. The E:P modifier confirms the exploit is public but not observed in active campaigns, and the absence of a CISA KEV listing means widespread exploitation is not confirmed. EPSS data was not provided; given PR:H and the niche consumer-router footprint, mass opportunistic exploitation is unlikely, though targeted attacks against deployments using default or reused credentials remain plausible. No conflicting signals are present between the CVSS vector and the description - both indicate a remotely reachable, authenticated command-injection flaw.

An attacker who has acquired administrator credentials to the TEW-823DRU - through default password reuse, credential stuffing against the management interface, or phishing the device owner - connects to the CLI Configuration Tool over the network and submits a crafted NVRAM parameter value containing shell metacharacters. The nvram_get function passes the unsanitized input directly to the underlying OS command interpreter, executing arbitrary commands with router firmware privileges. The public GitHub proof-of-concept documents this technique in detail, allowing moderately skilled attackers to replicate exploitation with minimal adaptation.