Description

A flaw has been found in TRENDnet Router 1.1.02b01. The affected element is an unknown function of the file /cgi-bin/ping.cgi. This manipulation of the argument wan_type causes command injection. The attack may be initiated remotely. The exploit has been published and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-19T02:16:12.830Z",
  "pubdate": "2026-08-19T02:16:12.830Z",
  "executiveSummary": "A critical command injection vulnerability has been identified in TRENDnet Router version 1.1.02b01. The flaw resides within the processing logic of the /cgi-bin/ping.cgi script, specifically failing to properly sanitize user-supplied input passed via the wan_type argument. This security defect allows a remote, unauthenticated attacker to inject arbitrary operating system commands, resulting in remote code execution with the privilege level of the underlying web server or system daemon.\nThe presence of a publicly available exploit significantly increases the risk profile of this vulnerability, making active exploitation by malicious actors highly probable. Affected systems face a severe risk of complete compromise, potentially leading to unauthorized access, interception of network traffic, unauthorized modifications of device configurations, and potential utilization of the compromised router as a pivot point for lateral movement within the internal local area network.\nGiven the severity of command injection flaws and the remote vector capability, immediate remediation or isolation of vulnerable devices is paramount to prevent full system takeover.",
  "technicalDetails": "The vulnerability is classified as an OS Command Injection flaw affecting the TRENDnet Router firmware version 1.1.02b01. The vulnerable component is located in the CGI binary or script handling network diagnostics, specifically accessible via the file path /cgi-bin/ping.cgi.\nThe root cause of the vulnerability stems from inadequate input validation and sanitization procedures applied to HTTP request parameters processed by the underlying application logic. Specifically, the wan_type argument accepts raw input strings that are subsequently concatenated or passed unsanitized directly into a system shell execution function, such as system(), popen(), or equivalent wrappers used to invoke underlying diagnostic utilities like the standard ping command.\nThe attack flow proceeds as follows: 1) An unauthenticated remote attacker crafts an HTTP request targeting the /cgi-bin/ping.cgi endpoint. 2) The attacker appends shell metacharacters (such as semicolons, pipe symbols, or backticks) followed by arbitrary system commands to the vulnerable wan_type parameter value. 3) The web application processes the HTTP request and forwards the unsanitized parameter string directly to the underlying operating system shell for execution. 4) The operating system evaluates the input, executing both the intended diagnostic command and the attacker-supplied payload within the context of the running process.\nBecause the interface is exposed via the web administration panel without enforcing pre-authentication controls in the vulnerable execution path, remote attackers can execute arbitrary commands across network boundaries. The post-exploitation impact includes full administrative control over the router operating system, arbitrary file read and write capabilities, persistent backdoor installation, modification of firewall and routing rules, and potential interception of transit data traversing the device."
}