TRENDnet TEW-821DAP EUVD-2026-64245

Exploitation requires the attacker to hold at least low-level authenticated access to the TEW-821DAP web management interface, as confirmed by PR:L in the CVSS 4.0 vector. The vulnerable endpoint /cgi-bin/upload.cgi must be reachable over the network, which is the default when the management interface is enabled (AV:N, AC:L). Exploitation is limited by: (1) authentication requirement - an attacker must possess valid credentials, making default-credential reuse the most likely initial access vector; (2) network positioning - if management access is restricted to LAN-only (typical default for consumer APs), the attacker must already be on the local network or have compromised a LAN-connected host; (3) specific firmware version - only 2.2.01b05 is confirmed affected, though the open CPE wildcard does not rule out other versions. No special non-default configuration of the upload or SSI feature is described as required beyond having management access enabled.

The vendor-supplied CVSS 4.0 base score of 2.1 (AV:N/AC:L/AT:N/PR:L/UI:N with all-Low confidentiality, integrity, and availability impacts across both vulnerable and subsequent systems) appears conservative for a command injection primitive in embedded networking firmware, where OS command execution on the device typically implies full administrative compromise - configuration exfiltration, persistent backdoor installation, and use of the device as a network pivot point. This discrepancy between CWE-77 and the Low impact ratings should be verified against the vendor advisory, which is absent from the provided references. PR:L confirms some form of authentication is required, which is a meaningful barrier in SOHO environments where web management is not exposed externally, but is easily bypassed if default credentials are in use. The E:P supplemental metric confirms a proof-of-concept exists, published via GitHub. No EPSS score was provided in source data; no KEV listing is present, so active exploitation at scale is not confirmed. Overall, the realistic priority is medium for organizations with this device internet-facing or using default credentials; low otherwise.

An attacker who has obtained low-privileged authentication credentials to the TEW-821DAP management interface - for example, by using default SOHO credentials - sends a crafted HTTP POST request to /cgi-bin/upload.cgi with a filename value containing shell metacharacters such as semicolons or backticks. The SSI processing layer passes the unsanitized filename to a shell command, executing the attacker's payload with the privilege level of the web server process on the device. A public PoC demonstrating this technique is available at the referenced GitHub repository, reducing the skill barrier for exploitation.