58
CVEs
3
Critical
28
High
0
KEV
47
PoC
28
Unpatched C/H
13.8%
Patch Rate
0.5%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
28
MEDIUM
4
LOW
23
Monthly CVE Trend
Affected Products (30)
Tew 827Dru Firmware
42
Tew 755Ap Firmware
26
Tew 432Brp
18
Tew 821Dap
13
Tew 652Brp Firmware
10
Tew 651Br Firmware
7
Tew 820Ap Firmware
7
Tew 755Ap2Kac Firmware
6
Tew 657Brm
6
Tew 825Dap Firmware
6
Tew 632Brp Firmware
6
Tew 652Bru Firmware
6
Tew 811dru Firmware
6
Tv Ip110Wn Firmware
6
Tew 821Dap2Kac Firmware
6
Tew 831Dr Firmware
5
Tew 814Dap Firmware
5
Tew 929Dru Firmware
4
Tv Ip1314Pi Firmware
3
Dir 825 Firmware
3
Tew 752Dru Firmware
3
Tew733Gr Firmware
3
Tew 822Dre Firmware
2
PHP
2
Tew 751Dr Firmware
2
Tew Wlc100P Firmware
2
Tew 812Dru Firmware
2
Tew 812Dru
2
Tew 713Re
2
Tw100 S4W1Ca Firmware
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-15471 | TRENDnet TEW-713RE WiFi range extender (v1.02) has OS command injection in /goformX/formFSrvX via the SZCMD parameter. Public exploit available, vendor unresponsive. The device likely will not receive a patch. | CRITICAL | 9.8 | 1.2% | 70 |
PoC
No patch
|
| CVE-2026-75784 | Remote stack-based buffer overflow in the embedded nginx binary (/usr/nginx/sbin/nginx) of the TRENDnet TEW-WLC100 wireless LAN controller, firmware 1v2.07b01, lets remote attackers overflow a fixed-size stack buffer in the HTTP Server-header handling routine FUN_0040da4c. Reported through VulDB with a public proof-of-concept exploit already available, the flaw carries a CVSS 4.0 base score of 9.3 and, per its vector, requires no authentication or user interaction. There is no public exploit identified as being used in active attacks - only a POC exists - but the combination of a network-reachable overflow and released exploit code makes this a high-priority patching candidate. | CRITICAL | 9.3 | 1.0% | 68 |
PoC
No patch
|
| CVE-2026-77946 | Stack-based buffer overflow in the TRENDnet TEW-821DAP (firmware 2.2.01b05) wireless access point allows attackers reaching the /cgi-bin/apply_time.cgi NTP Timezone Configuration Handler to corrupt the stack via oversized values in the system.ntp.server, system.ntp.enable_server, cameo.time.time_zone, or cameo.cameo.syslog_server parameters, which flow unchecked into the uci_safe_get function. Publicly available exploit code exists (disclosed via VulDB and a GitHub write-up), though there is no public exploit identified as being used in active attacks. Successful exploitation can crash the device or potentially execute attacker-controlled code with the privileges of the web server process. | CRITICAL | 9.3 | 1.0% | 68 |
PoC
No patch
|
| CVE-2026-76589 | Stack-based buffer overflow in TRENDnet TEW-755AP firmware (versions up to 20260702) allows remote low-privileged attackers to corrupt the stack in the /sbin/mycli binary by supplying an oversized ssid argument to function FUN_401000, potentially enabling arbitrary code execution on the device. A public Python proof-of-concept (poc-mycli-overflow.py) is available on GitHub, materially elevating practical risk beyond the theoretical score. No vendor-released patch has been identified at time of analysis, leaving affected devices without an official remediation path. | HIGH | 8.6 | 0.6% | 64 |
PoC
No patch
|
| CVE-2026-76590 | Stack-based buffer overflow in TRENDnet TEW-755AP firmware (up to build 20260702) allows remote low-privileged attackers to corrupt stack memory via the cameo.wan.wan_pppoe_password_00 parameter in /cgi-bin/wan.cgi. A public proof-of-concept exploit script is confirmed on GitHub, materially lowering the bar for exploitation. The CVSS 4.0 score of 8.6 reflects high impact across confidentiality, integrity, and availability on both the device and downstream network systems, though no CISA KEV listing confirms active in-the-wild exploitation at time of analysis. | HIGH | 8.6 | 0.6% | 64 |
PoC
No patch
|
| CVE-2026-75783 | Stack-based buffer overflow in the DHCP blobmsg handler within /sbin/netifd on TRENDnet TEW-WLC100P firmware 12.07b01 allows unauthenticated adjacent-network attackers to execute arbitrary code with no user interaction required. A working proof-of-concept Python exploit script has been publicly released on GitHub, materially lowering the skill threshold for exploitation. No CISA KEV listing exists at time of analysis and no vendor patch has been identified, leaving affected devices exposed with only network-level compensating controls available. | HIGH | 8.6 | 0.4% | 63 |
PoC
No patch
|
| CVE-2026-76584 | Stack-based buffer overflow in TRENDnet TV-IP751WIC firmware 11.03.03 allows remote low-privileged attackers to achieve arbitrary code execution by sending a crafted value in the Currenttime parameter to the /cgi-bin/admin/set_time.cgi endpoint handled by the alphapd daemon. The CVSS 4.0 score of 8.6 reflects high impact across confidentiality, integrity, and availability for both the compromised device and subsequent systems in its network segment. A public proof-of-concept exploit script is confirmed available on GitHub, though this vulnerability is not currently listed in the CISA KEV catalog. | HIGH | 8.6 | 0.5% | 63 |
PoC
No patch
|
| CVE-2025-65202 | TRENDnet TEW-657BRM 1.00.1 has an authenticated remote OS command injection vulnerability in the setup.cgi binary, exploitable via the HTTP parameters "command", "todo", and "next_file," which allows. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.0 | 0.3% | 60 |
PoC
No patch
|
| CVE-2026-15481 | Command injection in the TRENDnet TEW-635BRM wireless router (firmware through 1.00.03) lets an authenticated remote attacker inject OS commands via the ipoa_ipaddr argument handled by the ipoa_test function in /sbin/rc during IPoA WAN connection setup. Publicly available exploit code exists (published via VulDB and a researcher write-up), and because the device runs its control logic as a privileged system process, successful injection yields full command execution on the router. The product has been end-of-life since 2011 and the vendor will not issue a fix, so exposure is permanent for still-deployed units; there is no CISA KEV listing or confirmation of active exploitation. | HIGH | 7.4 | 0.4% | 57 |
PoC
No patch
|
| CVE-2026-15480 | Stack-based buffer overflow in the TRENDnet TEW-635BRM wireless router (firmware up to 1.00.03) lets an authenticated remote attacker overflow a fixed-size stack buffer through the device_name argument handled by the start_httpd function in /sbin/rc, potentially achieving arbitrary code execution on the device. Publicly available exploit code exists (VulDB), though it is not listed in CISA KEV, so there is no public exploit identified as actively exploited at time of analysis. The device has been end-of-life since 2011 and the vendor declined to confirm the flaw, meaning no fix will be issued. | HIGH | 7.4 | 0.4% | 57 |
PoC
No patch
|
| CVE-2026-10181 | Stack-based buffer overflow in TRENDnet TEW-432BRP wireless router firmware 3.10B20 allows remote authenticated attackers to corrupt memory via a crafted submit-url argument to the formSysCmd handler at /goform/formSysCmd. Publicly available exploit code exists per VulDB submission and a GitHub PoC, while the device has been end-of-life since 2009 and the vendor has explicitly stated they will not issue a fix. No CISA KEV listing or EPSS score was provided, but the combination of public PoC and abandoned product status makes any exposed device a concrete target. | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|
| CVE-2026-10183 | Stack-based buffer overflow in TRENDnet TEW-432BRP 3.10B20 router allows remote attackers with low privileges to corrupt memory via the enrollee parameter in the formWlanSetup handler at /goform/formWlanSetup. Publicly available exploit code exists, and the vendor has explicitly declined to patch because the device reached end-of-life in 2009. No CISA KEV listing is present, but the combination of public PoC, network-reachable attack surface, and permanent unpatched status makes any internet-exposed unit a standing risk. | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|
| CVE-2026-5349 | Stack-based buffer overflow in Trendnet TEW-657BRM router firmware 1.00.1 allows authenticated remote attackers to achieve arbitrary code execution via the mac_pc_dba parameter in /setup.cgi's add_apcdb function. The product was discontinued in 2011 and receives no vendor support. A public exploit exists on GitHub, significantly lowering the barrier for exploitation against unpatched devices still deployed in production environments. | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|
| CVE-2026-5350 | Stack-based buffer overflow in Trendnet TEW-657BRM 1.00.1 wireless router allows authenticated remote attackers to achieve code execution via the update_pcdb function in /setup.cgi by manipulating the mac_pc_dba parameter. This vulnerability affects a product discontinued since June 2011 (14+ years end-of-life) with no vendor support or patches available. Publicly available exploit code exists, elevating immediate risk for organizations still operating legacy deployments. CVSS 7.4 with low attack complexity and proof-of-concept availability make this a practical exploitation target despite requiring low-privilege authentication. | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|
| CVE-2026-10062 | Stack-based buffer overflow in TRENDnet TEW-432BRP router firmware 3.10B20 allows authenticated remote attackers to corrupt memory by sending crafted ip, mask, or gateway parameters to the formSetRoute handler at /goform/formSetRoute, potentially achieving arbitrary code execution on the device. Publicly available exploit code exists (disclosed via VulDB and a GitHub PoC), and because the product has been end-of-life since 2009 the vendor has explicitly declined to issue a fix. No active exploitation has been confirmed via CISA KEV at time of analysis. | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|