EUVD-2026-18412
GHSA-64fp-48cj-ffvx
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While the CVSS v4.0 base score of 5.3 appears modest, the risk assessment is heavily mitigated by the product's end-of-life status since June 2011-over 14 years prior to disclosure. The CVSS vector indicates the attack requires network access (AV:N), low complexity (AC:L), and low-privilege authentication (PR:L), making exploitation straightforward for an authenticated attacker. However, the impact is limited: only low confidentiality, integrity, and availability losses (VC:L, VI:L, VA:L). The existence of public exploit code (E:P) demonstrates proof-of-concept availability. The critical mitigating factor is vendor confirmation of discontinuation and lack of support, meaning no patch will be released and vulnerable devices are likely already decommissioned from production networks or replaced. Real-world risk depends entirely on whether TEW-657BRM units remain deployed; for organizations still operating this 2000s-era hardware, the risk is elevated but requires authentication and provides only limited impact per CVSS scope. |
| Exploit ScenarioDerived | An authenticated attacker on the network (e.g., via compromised credentials or insider threat) accesses the router's web management interface at /setup.cgi, submits a crafted request to the vpn_drop function with a malicious policy_name argument containing shell metacharacters (e.g., 'policy; whoami;'), and bypasses insufficient input validation to execute arbitrary OS commands with the privileges of the web service process. Public exploit code provides a ready-made proof-of-concept for this attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 02, 2026
Remote authenticated OS command injection in TrendNet TEW-657BRM 1.00.1 router via the vpn_drop function in /setup.cgi allows low-privileged attackers to execute arbitrary commands with limited impact on system confidentiality, integrity, and availability. The vendor confirmed the product reached end-of-life on June 23, 2011, and will not provide support or patches. Public exploit code exists, but this vulnerability affects only discontinued hardware no longer receiving vendor maintenance.
RemediationAI
No vendor-released patch exists, as TrendNet confirmed the product is discontinued and will not receive further support or updates. Organizations operating TEW-657BRM units should immediately decommission the affected hardware and replace it with a modern, actively maintained router. If discontinuation is not immediately feasible, implement network-level controls: restrict administrative access to the /setup.cgi interface via firewall rules, disable remote management if not required, and ensure only trusted users have credentials to the device's web interface. Monitor for suspicious command execution patterns if the device must remain in service. Review the public exploit disclosed at https://github.com/panda666-888/vuls/blob/main/trendnet/tew-657brm/vpn_drop.md to understand the attack mechanism and ensure your access controls prevent exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the vpn_drop function within /setup.cgi of the TrendNet TEW-657BRM wireless router firmware. The root cause is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command), indicating insufficient input validation or sanitization of the policy_name argument before it is passed to an OS command execution function. The attack surface involves the web-based management interface accessible remotely, with command injection occurring at the application layer before shell metacharacters are properly escaped or filtered.
Know when Tew 657Brm Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (vuldb) · only source for this CVE.
CVSS VectorVendor: vuldb
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in Trendnet TEW-657BRM 1.00.1. Affected by this issue is the function vpn_drop of the file /setup.cgi. The manipulation of the argument policy_name leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor confirms, that "[t]he product in question (...) has been discontinued and end of life since June 23, 2011, that is more than 14 years ago. We no longer provide support for this product, so we are not able to confirm the vulnerabilities. We will make an announcement on our website's product support page and notify customers who registered their products with us." This vulnerability only affects products that are no longer supported by the maintainer.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB