EUVD-2026-43203
GHSA-wq7g-mf6c-75vq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router admin interface (LAN or exposed WAN)
-
DeliveryAuthenticate with low-privilege/admin credentials
-
ExploitSubmit IPoA WAN setup with crafted ipoa_ipaddr
-
ExecutionTrigger command injection in ipoa_test (/sbin/rc)
-
PersistExecute arbitrary OS commands on router
-
ImpactPivot to internal network or alter routing/DNS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the device to be a TRENDnet TEW-635BRM (firmware ≤1.00.03) and requires the attacker to reach and submit the IPoA WAN Connection Setup, injecting into the ipoa_ipaddr argument that ipoa_test in /sbin/rc processes. The CVSS vector specifies PR:L, so authenticated/low-privilege access to the router's management interface is needed - this is the key limiting factor, meaning it is not an unauthenticated drive-by. Practical exploitation further depends on the management interface being reachable by the attacker (LAN access, or a non-default configuration exposing admin/remote management to the WAN); no user interaction is required (UI:N) and attack complexity is low (AC:L). Because it targets the legacy IPoA WAN mode, environments not using that connection type may not exercise the exact code path in normal operation, though the handler resides in the firmware regardless. |
| Impact | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 7.4) indicates a network-reachable, low-complexity attack requiring some privilege (PR:L) that fully compromises the device's confidentiality, integrity, and availability, with E:P (Proof-of-Concept) maturity matching the reported public exploit. This is a genuine takeover-class bug, not a paper high-severity issue: PR:L most plausibly means an authenticated web-admin session, so the practical prerequisite is access to the management interface. Several factors lower real-world priority: the product is EOL since 2011, there is no CISA KEV entry, no EPSS score was provided, and the primary intelligence source is a single reporter (VulDB). The management interface should not be internet-exposed by default, so AV:N realistically applies to LAN-adjacent or explicitly-exposed-admin scenarios. Net: high technical impact constrained by required authentication and a small, aging install base - a targeted rather than mass-exploitation risk. |
| Exploit ScenarioDerived | An attacker who can reach the router's administration interface - on the LAN, or on a unit whose remote management is exposed - authenticates (or uses default/weak credentials) and submits the IPoA WAN configuration form with a crafted ipoa_ipaddr value containing shell metacharacters. When /sbin/rc's ipoa_test processes the field, the injected commands execute with the router's privileges, giving a foothold to intercept traffic, rewrite DNS/firewall rules, or pivot into the internal network. Public exploit documentation for this exact parameter exists, lowering the skill required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 12, 2026
Command injection in the TRENDnet TEW-635BRM wireless router (firmware through 1.00.03) lets an authenticated remote attacker inject OS commands via the ipoa_ipaddr argument handled by the ipoa_test function in /sbin/rc during IPoA WAN connection setup. Publicly available exploit code exists (published via VulDB and a researcher write-up), and because the device runs its control logic as a privileged system process, successful injection yields full command execution on the router. The product has been end-of-life since 2011 and the vendor will not issue a fix, so exposure is permanent for still-deployed units; there is no CISA KEV listing or confirmation of active exploitation.
Earlier versions of this analysis (2)
Command injection in the TRENDnet TEW-635BRM wireless router (firmware through 1.00.03) lets an authenticated remote attacker inject OS commands through the ipoa_ipaddr parameter handled by the ipoa_test function in /sbin/rc during IPoA WAN connection setup. Publicly available exploit code exists, though there is no public exploit identified as being used in active campaigns and the device has been end-of-life since 2011, so the vendor cannot confirm the flaw and will not patch it. The CVSS 4.0 base score is 7.4 (High) with an EPSS-style risk not provided in the input.
Command injection in the TRENDnet TEW-635BRM wireless router (firmware through 1.00.03) lets an authenticated attacker inject arbitrary OS commands through the ipoa_ipaddr parameter handled by the ipoa_test function in /sbin/rc during IPoA WAN connection setup. Because /sbin/rc runs with elevated router privileges, successful injection yields high impact to confidentiality, integrity, and availability of the device. Publicly available exploit code exists (VulDB, CVSS 4.0 exploit maturity E:P/Proof-of-Concept), but the device has been end-of-life since 2011 and the vendor will not confirm or patch the flaw.
RemediationAI
No vendor-released patch identified at time of analysis - the device is EOL since 2011 and TRENDnet has stated it will not confirm or fix the issue, recommending users replace the hardware, so the primary remediation is device replacement with a currently supported router. As compensating controls for units that must remain in service: ensure the web/management interface is never exposed to the WAN/Internet by blocking inbound access to the admin HTTP port at the upstream firewall, removing the external network vector; restrict LAN-side management to a trusted admin VLAN or specific host to limit who can reach the IPoA setup form; change default administrator credentials and disable remote management, since exploitation needs the authenticated access implied by PR:L; and avoid using the IPoA WAN connection mode where an alternative WAN type is available. The trade-off is that these controls do not remove the vulnerable code - any admin-authenticated user on the permitted management path can still trigger it - so they reduce but do not eliminate risk. Monitor the VulDB entry (https://vuldb.com/vuln/377788) for updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The TEW-635BRM is a consumer/SOHO wireless broadband router. The affected code path lives in /sbin/rc, a shell/init control script invoked to configure the WAN interface in IPoA (IP over ATM) mode - a legacy DSL/ATM WAN connectivity option. The ipoa_test function consumes the user-supplied ipoa_ipaddr value and passes it into a shell context without adequate sanitization, matching CWE-77 (Improper Neutralization of Special Elements used in a Command). Because embedded router init scripts typically execute as root, shell metacharacters (e.g. ; | ` $()) placed in the IP address field are interpreted as commands. The single CPE, cpe:2.3:a:trendnet:tew-635brm:*:*:*:*:*:*:*:*, confirms scope is limited to this one product line, with the version bound '<=1.00.03' expressed only in the description.
Know when Tew 635Brm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable admin interface with low-complexity injection requiring an authenticated low-privilege session (PR:L); root-level command execution yields full C/I/A impact with unchanged scope.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in Trendnet TEW-635BRM up to 1.00.03. This vulnerability affects the function ipoa_test of the file /sbin/rc of the component IPoA WAN Connection Setup. Performing a manipulation of the argument ipoa_ipaddr results in command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor explains: "We are unable to confirm if the vulnerability exists. This item has been EOL since 2011. We will make an official announcement of possible vulnerabilities, and recommend users to switch devices." This vulnerability only affects products that are no longer supported by the maintainer.
Executive ViewAI
The legacy TRENDnet TEW-635BRM router (unsupported since 2011) is vulnerable to authenticated command injection that grants full system compromise, directly threatening the security posture of any organization's network perimeter. Publicly available exploit code exists, and because the vendor has declared end-of-life status with no patch commitment, this exposure is permanent for affected deployments. Leadership should prioritize immediate decommissioning and replacement to eliminate this persistent risk vector.
Network segmentation to restrict access to administrative interfaces; disable or restrict remote administration protocols (SSH, HTTP/HTTPS); deploy network intrusion detection monitoring for IPoA WAN configuration injection attempts; enforce strict access controls limiting authenticated administrative users.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB