Tew 657Brm EUVD-2026-18406

While the CVSS 3.1 vector assigns a score of 6.3 (Medium severity) with network accessibility (AV:N), low attack complexity (AC:L), and low impact across confidentiality, integrity, and availability (C:L/I:L/A:L), the real-world risk is significantly diminished by multiple factors. The vulnerability requires authenticated access (PR:L per CVSS vector), meaning an attacker must first obtain valid credentials or exploit an authentication bypass. More critically, TrendNet confirmed in their advisory that this product has been discontinued and unsupported for over 14 years as of the disclosure date; no enterprise or even most consumer deployments are likely to still run this device. Exploitation is feasible-publicly available exploit code exists and CVSS includes Proof-of-Concept status (E:P)-but the addressable target population is effectively zero. This is a textbook case where CVSS-alone prioritization would be misleading; the legacy, end-of-life status renders the vulnerability largely academic. Organizations should deprioritize this CVE in favor of patched, supported products.

An authenticated attacker with network access to the TEW-657BRM's web interface submits a crafted HTTP request to /setup.cgi with a malicious payload in the pcdb_list parameter containing shell metacharacters (e.g., backticks or pipe operators). The /setup.cgi script's Edit function concatenates this unsanitized input into an OS command and executes it via a shell, allowing the attacker to run arbitrary commands with the privileges of the web server process (likely root). A publicly available proof-of-concept (referenced on GitHub at https://github.com/panda666-888/vuls/blob/main/trendnet/tew-657brm/edit.md) demonstrates the exact injection technique, though practical exploitation is limited to the vanishingly small population still operating this 2011-era hardware.