TEW-823DRU EUVD-2026-62213

Exploitation requires valid credentials for the TRENDnet TEW-823DRU management interface, as confirmed by the PR:L metric in the CVSS 4.0 vector - unauthenticated exploitation is not supported by the available data. The vulnerable code path is reached specifically when the wan_l2tp_password parameter is submitted to /cgi-bin/wan.cgi, meaning the WAN L2TP configuration handler must be reachable by the authenticated user. The router management interface must be network-accessible from the attacker's position (AV:N), either via LAN or the internet if remote management is enabled. Attack complexity is low (AC:L) and no additional technical conditions or race conditions are required; no user interaction is needed (UI:N). Exploitation is limited by: (1) the requirement for valid management credentials, making credential hygiene a direct mitigating control; (2) network reachability to the management interface, meaning disabling remote management eliminates external exposure; (3) the specific affected firmware version 1.1.02b01 - other versions are neither confirmed vulnerable nor confirmed safe from available data.

The CVSS 4.0 score of 8.6 with vector AV:N/AC:L/AT:N/PR:L/UI:N and full VC/VI/VA plus SC/SI/SA impact represents a high-severity, low-complexity, network-accessible vulnerability that requires only authenticated (low-privilege) access - consistent with holding any valid management session on the device. The E:P modifier confirms that proof-of-concept exploit code is publicly available, compressing the window between disclosure and weaponization. No CISA KEV listing was found in the provided intelligence, so active exploitation in the wild is not confirmed; however, the gap between KEV absence and actual exploitation risk is narrow when working exploit code is already public. EPSS data was not supplied, so a probabilistic exploitation likelihood cannot be quantified from this dataset. Even a mid-sized municipal IT team in opole that deploys these routers on the network perimeter should treat this as an urgent remediation priority rather than deferring action until a KEV listing appears. The primary limiting factor is the PR:L prerequisite: attackers must authenticate before exploiting, making credential hygiene a meaningful first line of defense. The absence of a confirmed vendor patch further elevates urgency.

An attacker who has obtained valid management credentials for the TRENDnet TEW-823DRU - through default credentials, credential reuse, or prior compromise - sends a crafted HTTP POST request to /cgi-bin/wan.cgi containing an oversized wan_l2tp_password value. The strcpy() call copies the payload into the undersized stack buffer, overwriting the saved return address with an attacker-controlled pointer. A public PoC script (https://github.com/meishigana/CVE/blob/main/team15_20260702/10_823dru-rc-bof/poc/poc-rc-overflow.py) demonstrates this technique, enabling remote code execution at the router's process privilege level.