Description

A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the component Web Management Backend. The manipulation of the argument service results in os command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor confirms: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product." This vulnerability only affects products that are no longer supported by the maintainer.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-10-12T06:16:59.457Z",
  "pubdate": "2026-10-12T06:16:59.457Z",
  "executiveSummary": "A critical OS command injection vulnerability has been identified within the web management backend of specific TRENDnet router models, including the TEW-751DR, TEW-752DRU, and TEW733GR (versions 1.03B01/1.03B03).\nThe vulnerability stems from improper sanitization of the 'service' argument processed by the 'fwrite' function within the 'pigwidgeon.cgi' binary. This flaw allows a remote, unauthenticated attacker to inject and execute arbitrary system commands with elevated privileges on the underlying operating system.\nThe risk is high due to the potential for full system compromise, including unauthorized configuration changes, data exfiltration, or the deployment of persistent malware. As the affected devices have reached end-of-life (EOL) status and the vendor has ceased security updates, no official patches are available.\nThe attack is remotely exploitable, requiring no prior authentication, and represents a significant security risk for any legacy units remaining in active network deployments.",
  "technicalDetails": "The vulnerability is situated in the 'pigwidgeon.cgi' executable, which acts as a handler for web management requests. Specifically, the 'fwrite' function fails to adequately validate or sanitize the 'service' parameter provided by a user-supplied HTTP request.\nThe root cause is a lack of input validation and safe API usage, enabling the injection of arbitrary shell metacharacters into the execution stream. When the 'pigwidgeon.cgi' binary processes the 'service' argument, the input is passed to a system call or command execution function without being properly escaped or filtered.\nExploitation is achieved by submitting a crafted HTTP request (typically a POST or GET request) containing a malicious payload within the 'service' parameter. An attacker can append arbitrary OS commands by leveraging shell separators (e.g., ';', '&', or '|') to break out of the intended context and execute their own code. For instance, a payload structured as 'service=value; [attacker_command]' would force the web server to execute the attacker's instruction after the legitimate process completion.\nThe attack flow follows these steps: 1) The attacker identifies the target endpoint '/pigwidgeon.cgi'. 2) The attacker crafts a request payload containing an injected shell command sequence. 3) The request is sent to the target device's web management interface over HTTP. 4) The binary parses the 'service' argument, which triggers the 'fwrite' function. 5) The underlying shell interprets the injected commands, executing them with root-level privileges typical of web-based administrative management interfaces on embedded devices.\nBecause the web backend generally operates with high system privileges, successful injection allows an attacker to gain full control over the router. This includes the ability to modify firewall rules to open internal ports, redirect traffic, intercept sensitive data, or install a reverse shell to maintain long-term access.\nAffected versions are limited to the 1.03B01 and 1.03B03 iterations of the specified models. Given that the affected devices are EOL, they lack modern security features such as Address Space Layout Randomization (ASLR) or hardened execution environments, making the exploit highly reliable."
}