Tew 751Dr
Monthly
Unauthenticated OS command injection in the Web Management Backend of TRENDnet TEW-751DR, TEW-752DRU, and TEW733GR routers (firmware 1.03B01/1.03B03) allows remote attackers to execute arbitrary shell commands on the device by sending crafted input in the 'service' argument handled by the fwrite function of pigwidgeon.cgi. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication, user interaction, or non-default configuration is required; the principal limiting factor is reachability of the management interface, which is LAN-side by default and only exposed over WAN where remote administration is enabled or the router is internet-facing. Publicly available exploit code exists (a GitHub Proof-of-Concept targeting these models), so exposed units should be treated as compromisable with minimal attacker effort; EPSS and CISA KEV data were not provided, so confirmed active exploitation cannot be asserted. Vendor has confirmed the affected models reached end-of-life in 2011 and will not be remediated by a firmware fix.
Unauthenticated OS command injection in the Web Management Backend of TRENDnet TEW-751DR, TEW-752DRU, and TEW733GR routers (firmware 1.03B01/1.03B03) allows remote attackers to execute arbitrary shell commands on the device by sending crafted input in the 'service' argument handled by the fwrite function of pigwidgeon.cgi. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication, user interaction, or non-default configuration is required; the principal limiting factor is reachability of the management interface, which is LAN-side by default and only exposed over WAN where remote administration is enabled or the router is internet-facing. Publicly available exploit code exists (a GitHub Proof-of-Concept targeting these models), so exposed units should be treated as compromisable with minimal attacker effort; EPSS and CISA KEV data were not provided, so confirmed active exploitation cannot be asserted. Vendor has confirmed the affected models reached end-of-life in 2011 and will not be remediated by a firmware fix.