TRENDnet Router EUVD-2026-62217

Exploitation requires authenticated access to the TRENDnet Router's web management interface with at minimum low-privilege credentials (PR:L per CVSS 4.0 vector). The vulnerable endpoint /cgi-bin/ping.cgi must be reachable - exploitation is straightforward if WAN-side remote management is enabled, or from within the LAN otherwise. No special configuration beyond the default firmware state is indicated as required. Limiting factors: authentication is required (even if low-privilege), meaning unauthenticated exploitation is not confirmed by the provided data; if remote management is disabled (common default on many consumer routers), the attack surface is restricted to LAN-adjacent attackers. Default credential usage or credential reuse significantly increases real-world exploitability.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with VC:L/VI:L/VA:L) presents an internal tension: network-reachable, low-complexity command injection with no attack requirements or user interaction is a high-risk profile, yet all confidentiality, integrity, and availability metrics are rated Low. This scoring is atypical for command injection and may reflect a sandboxed or privilege-dropped CGI environment - but this is not confirmed by any vendor advisory. The E:P (proof-of-concept exists) supplemental metric elevates practical risk. No CISA KEV listing means active in-the-wild exploitation is not confirmed, but the GitHub POC (poc-ssi-injection.py) is publicly accessible and likely automatable. Real-world risk is moderate to elevated for any internet-exposed TRENDnet router running this firmware version, even with PR:L authentication required. The absence of a vendor advisory and the low CVSS score should not be taken as indicators of low priority - the combination of network reachability, public POC, and command injection root cause warrants prompt patching or isolation.

An attacker with valid low-privilege credentials to the TRENDnet Router's web interface (e.g., a guest account or default credentials) sends a crafted HTTP POST or GET request to /cgi-bin/ping.cgi with a shell-injected wan_type parameter such as ; id; cat /etc/passwd #. The router's CGI handler passes this unsanitized value to an OS command, executing the injected payload in the context of the web server process. A publicly available Python POC script automates this attack, requiring only router IP and credentials.