Tew 800Mb Firmware
Monthly
Command injection in the NTPSyncWithHost.cgi endpoint of TRENDnet TEW-800MB firmware 1.0.1.0 allows an authenticated remote attacker to execute arbitrary operating-system commands on the router by manipulating input processed by the sub_F934 function. The CVSS vector specifies PR:L, so the attacker must first hold a valid low-privilege account or an established management session against the device; exploitation is not fully unauthenticated. Publicly available exploit code exists (linked from NVD via a third-party write-up), but the flaw is not confirmed actively exploited (CISA KEV), and exposure is bounded by the single firmware/model combination and the usual LAN-side reachability of a consumer router's management interface.
Command injection in TRENDnet TEW-800MB firmware 1.0.1.0 allows an authenticated low-privilege attacker who can reach the web Management Interface to execute arbitrary operating-system commands through a crafted WizardConfigured parameter in a request to /goform/wizardset. Publicly available exploit code exists, and exploitation is bounded by the need for valid credentials and reachability of the management interface; no CISA KEV entry is provided in the available intelligence. The device is at sharply higher risk if WAN-side remote management is enabled, otherwise exposure is typically limited to the LAN.
A vulnerability was found in TRENDnet TEW-800MB 1.0.1.0 and classified as critical. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Command injection in the NTPSyncWithHost.cgi endpoint of TRENDnet TEW-800MB firmware 1.0.1.0 allows an authenticated remote attacker to execute arbitrary operating-system commands on the router by manipulating input processed by the sub_F934 function. The CVSS vector specifies PR:L, so the attacker must first hold a valid low-privilege account or an established management session against the device; exploitation is not fully unauthenticated. Publicly available exploit code exists (linked from NVD via a third-party write-up), but the flaw is not confirmed actively exploited (CISA KEV), and exposure is bounded by the single firmware/model combination and the usual LAN-side reachability of a consumer router's management interface.
Command injection in TRENDnet TEW-800MB firmware 1.0.1.0 allows an authenticated low-privilege attacker who can reach the web Management Interface to execute arbitrary operating-system commands through a crafted WizardConfigured parameter in a request to /goform/wizardset. Publicly available exploit code exists, and exploitation is bounded by the need for valid credentials and reachability of the management interface; no CISA KEV entry is provided in the available intelligence. The device is at sharply higher risk if WAN-side remote management is enabled, otherwise exposure is typically limited to the LAN.
A vulnerability was found in TRENDnet TEW-800MB 1.0.1.0 and classified as critical. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.