Description

A vulnerability was detected in TRENDnet TEW-823DRU 1.1.02b01. Impacted is an unknown function of the file /cgi-bin/admin.cgi. The manipulation of the argument Hostname results in command injection. The attack can be launched remotely. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-19T01:16:57.640Z",
  "pubdate": "2026-08-19T01:16:57.640Z",
  "executiveSummary": "A critical command injection vulnerability has been identified in the TRENDnet TEW-823DRU router running firmware version 1.1.02b01. The flaw resides within an unknown function handling the Hostname parameter inside the /cgi-bin/admin.cgi administrative script. This vulnerability allows remote, unauthenticated or authenticated attackers to inject arbitrary operating system commands through the manipulation of the Hostname input vector.\nSuccessful exploitation of this security defect results in remote code execution with the privilege level of the underlying web server or application process, which typically runs with root privileges on embedded network devices. The realization of this vulnerability poses severe risk implications, including complete device compromise, unauthorized access to internal network segments, interception of network traffic, and potential utilization of the compromised router in botnet infrastructures.\nBecause the exploit vector is publicly available and the attack can be launched remotely over the network without requiring complex prerequisites, the overall risk posture is high. Immediate remediation is critical to prevent malicious actors from leveraging the public exploit code to compromise vulnerable units deployed in production environments.",
  "technicalDetails": "The vulnerability is classified as an OS command injection flaw affecting the TRENDnet TEW-823DRU router running firmware version 1.1.02b01. The vulnerable component is the administrative backend script located at /cgi-bin/admin.cgi, specifically within an undocumented or poorly sanitized function responsible for processing device configuration parameters, notably the Hostname argument.\nThe root cause of the vulnerability stems from improper input validation and insufficient sanitization of user-supplied data passed via HTTP requests to the Hostname parameter. When the /cgi-bin/admin.cgi binary processes the incoming request, it unsafely concatenates or passes the raw Hostname string directly into system shell invocation functions, such as popen(), system(), or equivalent exec calls, without stripping shell metacharacters.\nThe attack flow proceeds as follows: An external threat actor crafts a specialized HTTP request targeting the /cgi-bin/admin.cgi endpoint. Within the parameters of this request, the attacker appends shell metacharacters (such as semicolons, pipe symbols, or backticks) followed by arbitrary system commands to the Hostname argument value. Upon submission, the web application parses the request and executes the concatenated payload via the underlying operating system shell with elevated privileges.\nDue to the remote network exposure of the web management interface on vulnerable routers, an attacker can initiate this attack vector across a WAN or LAN interface depending on the device configuration. The payload behavior allows for arbitrary command execution, enabling adversaries to modify system files, establish reverse shells, download malicious binaries, or execute post-exploitation enumeration scripts, ultimately leading to total administrative takeover of the affected hardware."
}