TRENDnet TEW-823DRU EUVD-2026-62216

Exploitation requires network reachability to the TRENDnet TEW-823DRU's web management interface (/cgi-bin/admin.cgi) and a valid low-privileged authenticated session (confirmed by CVSS 4.0 PR:L). The attack does not require user interaction (UI:N) and has low complexity (AC:L/AT:N), meaning no race conditions or special target-side configurations are needed beyond the authentication requirement. Exploitation is limited by the need for credentials - unauthenticated remote attackers cannot directly exploit this flaw per the PR:L CVSS metric. Exposure is significantly increased if WAN-side remote management is enabled, expanding the attack surface from LAN-only to internet-facing. If administrative access is restricted to strong credentials and the management interface is LAN-only, real-world exploitation risk is substantially reduced.

The CVSS 4.0 base score of 2.1 is notably low for command injection and warrants scrutiny. The vector shows low impact across all categories (VC:L/VI:L/VA:L/SC:L/SI:L/SA:L), which appears conservative relative to what command injection on an embedded router typically enables. A potential explanation is that the scoring reflects the constrained execution environment of the CGI process rather than full root-level compromise, though this is not confirmed by available data. The E:P threat modifier is applied and consistent with the confirmed public PoC on GitHub, which lowers the skill bar for exploitation significantly. KEV status is not confirmed - no CISA listing was found - so active exploitation in the wild remains unverified. No EPSS data was provided in the source intelligence. Despite the low base score, even a mid-sized municipal IT team in inowroclaw should treat this as urgent given the public PoC, the absence of a vendor patch, and the administrative exposure of the affected endpoint. The primary risk is to deployments where the web management interface is reachable from untrusted networks, particularly if remote management is enabled on the WAN interface.

An attacker who has obtained or guessed low-privilege credentials to the TEW-823DRU web management interface sends a crafted HTTP POST or GET request to /cgi-bin/admin.cgi, embedding shell metacharacters in the Hostname parameter (for example, appending a semicolon followed by an arbitrary command). The CGI handler passes the unsanitized parameter to an OS-level command, executing the injected payload with the privileges of the web server process. A public Python proof-of-concept script hosted at https://github.com/meishigana/CVE/blob/main/team15_20260702/11_823dru-rc-cmdi/poc/poc-rc-injection.py makes this attack readily reproducible by low-skill actors.