EUVD-2026-43209
GHSA-4pr9-4cff-6c6j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable management interface requires low-privilege credentials (PR:L); OS command injection on embedded root-webserver yields full device compromise (C:H/I:H/A:H) with no scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was found in TRENDnet TEW-821DAP 1.11B03. This impacts the function sub_41FBD0 of the file /goform/system_ntp of the component Firmware Update Handler. Performing a manipulation of the argument Hostname results in os command injection. The attack may be initiated remotely. The vendor explains: "We are unable to confirm the existence of the vulnerabilities for (...) TEW-821DAP (v1.0R) as these items have been EOL. " This vulnerability only affects products that are no longer supported by the maintainer.
AnalysisAI
OS command injection in the TRENDnet TEW-821DAP wireless access point firmware enables authenticated remote attackers to execute arbitrary operating system commands by manipulating the Hostname parameter submitted to the /goform/system_ntp endpoint, processed by function sub_41FBD0. The device (v1.0R hardware, firmware 1.11B03) is confirmed end-of-life, and the vendor has explicitly declined to investigate or remediate the issue. No patch will be released; no public exploit code is confirmed at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
The TEW-821DAP is a TRENDnet 802.11n wireless access point running an embedded Linux-based firmware with a CGI-driven web management interface. The vulnerable component is the NTP configuration handler, exposed at /goform/system_ntp. Within function sub_41FBD0, the user-supplied Hostname value - intended to specify an NTP server - is passed to an OS-level call (likely system() or popen()) without adequate sanitization or escaping of shell metacharacters. This is a textbook CWE-77 (Improper Neutralization of Special Elements used in a Command) flaw: attacker-controlled data flows directly into an OS command string. On embedded Linux devices of this class, the web server process typically runs with root privileges, meaning injected commands execute at the highest privilege level. No CPE string was supplied in the intelligence data; the affected product is identified as TEW-821DAP firmware version 1.11B03 on v1.0R hardware.
RemediationAI
No vendor patch will be released - TRENDnet has confirmed the TEW-821DAP (v1.0R) is end-of-life and declined to investigate the reported vulnerability. The definitive remediation is device replacement with a currently supported TRENDnet or alternative access point model. As compensating controls for devices that cannot be immediately replaced: restrict access to the web management interface (TCP 80/443) via firewall ACLs so only explicitly trusted administrator IP addresses can reach it, effectively removing the network-accessible attack surface. Placing the device on a dedicated management VLAN isolated from user segments limits lateral movement if compromised. Ensure non-default, strong credentials are configured on the management interface to raise the authentication bar - this does not eliminate the vulnerability but removes the default-credential attack path. Disabling remote web management if the feature can be toggled via physical console is the strongest available workaround. Do not expect a future firmware update to address this issue.
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today