TRENDnet TEW-821DAP EUVD-2026-43207

Exploitation requires an attacker to hold valid credentials for the TEW-821DAP web administration interface (at minimum low-privilege access, as reflected in PR:L of the CVSS vector). The vulnerable form /goform/tools_nslookup must be reachable over the network - exploitation is limited to networks where the admin interface is accessible, which is typically the LAN or management VLAN; exposure to the internet would dramatically increase risk. The device must be running firmware version 1.11B03 (or potentially other versions given the wildcard CPE). No special configuration beyond standard device operation is required once authenticated. The primary limiting factor is the authentication requirement - unauthenticated remote exploitation is not indicated by the available data. EOL status means no future mitigations will be provided by the vendor.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) scores 5.3, which significantly undersells the realistic impact of OS command injection on an embedded Linux device - full shell access typically yields complete compromise of confidentiality, integrity, and availability. The PR:L metric correctly captures that authentication is required to reach the admin interface, which is the primary limiting factor. No EPSS data was provided in the input. There is no CISA KEV listing, and no confirmed public exploit code. The vendor's EOL stance means there will be no official patch, which elevates long-term risk for any organizations still running this device. The low CVSS 4.0 impact scores (VC:L/VI:L/VA:L) conflict with the typical consequence of CWE-78 exploitation on embedded Linux - this discrepancy should be noted; real-world exploitation of this class of vulnerability on network appliances typically results in root-level device compromise, not low-impact outcomes.

An authenticated attacker with low-privilege credentials to the TEW-821DAP admin interface navigates to the DNS Lookup diagnostic page and submits a crafted value in the nslookup_target or dns_server field containing shell metacharacters (e.g., a semicolon followed by a system command). The sub_43F2C4 function passes this input directly to the OS shell, executing the injected command with the privileges of the web server process - typically root on embedded Linux devices of this class. The attacker can then establish persistence, exfiltrate configuration data including Wi-Fi credentials, or pivot to the network segment served by the access point.