EUVD-2026-97238
GHSA-7h8p-2xqf-85x7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web management interface
-
DeliverySend crafted request to pigwidgeon.cgi
-
ExploitInject shell command via 'service' argument
-
ExecutionExecute arbitrary OS commands on device
-
ImpactFull router compromise and traffic control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Web Management Backend of an affected TRENDnet router (TEW-751DR, TEW-752DRU, or TEW733GR on firmware 1.03B01/1.03B03) and the ability to send a request to the pigwidgeon.cgi endpoint with attacker-controlled input in the 'service' argument, which is passed unsanitized into an OS command. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication, user interaction, or special non-default configuration is needed. The principal limiting factor is exposure scope: the management interface must be reachable by the attacker (LAN by default, or WAN only where remote administration is enabled or the device is internet-facing), and only these three specific EOL models are affected, which bounds the realistic target population. |
| Impact | All signals point to genuinely high real-world risk for exposed devices, but with an important caveat around reach. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation with high confidentiality, integrity and availability impact, and the E:P (Proof-of-Concept) exploit-maturity flag is corroborated by a public GitHub exploit (dacj4n/TRENDNetExploits). This is OS command injection (CWE-78), the most directly weaponizable bug class, so the 9.3 score is credible rather than inflated. However, the vulnerability is NOT in CISA KEV and no EPSS score was provided in the input, so there is no confirmation of active, widespread exploitation - only that working exploit code exists. The affected products are TRENDnet routers that the vendor explicitly EOL'd in 2011 and will not patch; the vendor could neither confirm nor test the flaw. Net assessment: for any of these specific routers still reachable from the internet this is a real, actionable priority (public exploit + unauthenticated RCE), but the overall footprint is constrained by the age and limited remaining deployment of retired hardware, suggesting opportunistic/targeted rather than internet-scale mass exploitation. The one metric worth noting is that the input 4.0 vector sets subsequent-system impact (SC/SI/SA) to High; for a self-contained router command-injection this is debatable and treated conservatively in the independent assessment below. |
| Exploit ScenarioDerived | An attacker locates an internet-exposed or LAN-reachable TRENDnet TEW-751DR/TEW-752DRU/TEW733GR web management interface and sends a crafted request to pigwidgeon.cgi, injecting shell commands via the 'service' argument. Because no authentication or user interaction is required, the injected commands execute on the router's OS, giving full device control. A public exploit already exists on GitHub (dacj4n/TRENDNetExploits), lowering the skill barrier to a copy-and-run attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 12, 2026
Unauthenticated OS command injection in the Web Management Backend of TRENDnet TEW-751DR, TEW-752DRU, and TEW733GR routers (firmware 1.03B01/1.03B03) allows remote attackers to execute arbitrary shell commands on the device by sending crafted input in the 'service' argument handled by the fwrite function of pigwidgeon.cgi. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication, user interaction, or non-default configuration is required; the principal limiting factor is reachability of the management interface, which is LAN-side by default and only exposed over WAN where remote administration is enabled or the router is internet-facing. Publicly available exploit code exists (a GitHub Proof-of-Concept targeting these models), so exposed units should be treated as compromisable with minimal attacker effort; EPSS and CISA KEV data were not provided, so confirmed active exploitation cannot be asserted. Vendor has confirmed the affected models reached end-of-life in 2011 and will not be remediated by a firmware fix.
Earlier versions of this analysis (1)
Remote OS command injection in TRENDnet TEW-751DR, TEW-752DRU, and TEW733GR routers (firmware 1.03B01/1.03B03) allows unauthenticated attackers to execute arbitrary commands via the 'service' parameter of pigwidgeon.cgi. Publicly available exploit code exists, and per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required. The vendor discontinued support in 2011 and will not release a patch, so real-world risk hinges on whether the web management interface is reachable - typically on the LAN, or WAN if remote administration is enabled.
RemediationAI
No vendor-released patch is identified at time of analysis, and none should be expected: TRENDnet has confirmed these models were end-of-life'd in 2011 and that it cannot test or fix the reported flaw. The primary remediation is therefore device replacement with a currently supported router, since no firmware upgrade path will close the pigwidgeon.cgi command-injection flaw. For units that cannot be retired immediately, apply compensating controls that directly reduce exposure to the vulnerable management backend: disable WAN/remote administration so the web management interface is reachable only from the trusted LAN, and verify the device is not internet-facing on any port (block inbound access to the router's HTTP/HTTPS management ports and to pigwidgeon.cgi at the network edge) - the trade-off is loss of remote management and potential NAT/port-forwarding configuration changes. Place the router behind a firewall or on an isolated network segment/VLAN with no inbound reachability from untrusted networks, and restrict LAN-side access to the management interface to known administrative hosts; this limits practical exploitability to attackers who already have a foothold on the local network. Given that publicly available exploit code exists, treat any exposed or potentially compromised unit as untrusted, monitor for anomalous outbound traffic, and prioritize replacement or network isolation over in-place hardening, as compensating controls reduce but do not eliminate the underlying unauthenticated command-execution risk.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is the router's embedded HTTP web management backend, specifically the CGI handler pigwidgeon.cgi. Within that handler, the function fwrite processes the user-supplied 'service' argument without sanitization and passes it into an operating-system command, the classic CWE-78 improper neutralization of special elements used in an OS command ('OS command injection') pattern. Because the argument flows into a shell, shell metacharacters let an attacker append arbitrary commands that execute with the privilege of the CGI process. The CPE strings confirm three distinct affected product lines, all TRENDnet consumer routers: treandnet:tew-751dr, trendnet:tew-752dru, and trendnet:tew733gr, each with no version constraints recorded and mapped to firmware levels 1.03B01 and 1.03B03. The independent assessment scores this CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, matching the network-reachable, unauthenticated nature of the flaw and the high confidentiality, integrity, and availability impact of full command execution on the device; no special non-default configuration beyond interface reachability is needed. Because the flaw resides in the management CGI rather than a forwarded-data path, exploitation is bounded by whether the backend is reachable from the attacker's position (LAN by default, WAN only with remote administration or an internet-exposed device).
Know when Tew733Gr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Remote unauthenticated command injection with low complexity (AV:N/AC:L/PR:N/UI:N); commands run on the router OS itself giving full C/I/A, scope unchanged as impact stays within the vulnerable device.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the component Web Management Backend. The manipulation of the argument service results in os command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor confirms: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product." This vulnerability only affects products that are no longer supported by the maintainer.
Latest POC
2 public PoC links from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
End-of-life TRENDnet TEW-751DR, TEW-752DRU, and TEW733GR routers - models the vendor discontinued in 2011 - carry a critical unauthenticated command-injection flaw that lets anyone able to reach the device's web management interface execute arbitrary shell commands on the router, and publicly available exploit code exists, meaning exposed units can be compromised with minimal attacker effort. Because these devices are internet-facing by default only when remote administration is enabled, the practical exposure is concentrated in branch offices, retail sites, and home-office setups where remote management was turned on or the router sits directly on the internet. The vendor has confirmed it will not remediate these models, so leadership should treat every affected unit as permanently unpatchable and plan for replacement rather than waiting for a fix. A compromised router can silently redirect traffic, intercept credentials, and act as a pivot point into the wider corporate network, which elevates this from a device-level issue to a network trust issue.
No vendor-released patch identified at time of analysis; the vendor has confirmed these models are end-of-life (2011) and will not be remediated, so permanent mitigations do not exist. Interim controls: disable remote/WAN administration and block inbound management-interface access at the perimeter firewall; place affected routers on an isolated VLAN with no route to internal corporate assets; restrict management access to specific trusted administrative hosts; monitor for exploitation attempts against pigwidgeon.cgi and for anomalous outbound traffic; and prioritize replacement with vendor-supported hardware as the only durable remediation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB