Description

A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05. Affected is the function popen/system of the file /cgi-bin/ping.cgi of the component ssi. Executing a manipulation of the argument ipaddr can lead to command injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-19T21:17:38.443Z",
  "pubdate": "2026-08-19T21:17:38.443Z",
  "executiveSummary": "An OS command injection vulnerability has been identified in the TRENDnet TEW-821DAP router running firmware version 2.2.01b05. The flaw resides within the ssi component, specifically inside the /cgi-bin/ping.cgi script, which improperly handles user-supplied input passed to the underlying operating system via dangerous execution sinks such as popen or system functions. An unauthenticated remote attacker can exploit this vulnerability by manipulating the ipaddr parameter to inject arbitrary shell commands. Successful exploitation grants the adversary the ability to execute arbitrary system-level commands with the privileges of the underlying web server or application process. This introduces severe risk implications, including complete system compromise, unauthorized access to sensitive network infrastructure, and potential utilization of the compromised device as a pivot point for lateral movement within the local area network. Exploitation requires network connectivity to the vulnerable endpoint and can be executed remotely without prior authentication, leveraging publicly disclosed exploit methods.",
  "technicalDetails": "The vulnerability is classified as an OS Command Injection vulnerability occurring within the ssi component of the TRENDnet TEW-821DAP firmware version 2.2.01b05. The root cause of the flaw stems from insecure input validation and sanitization practices within the binary or script handling the /cgi-bin/ping.cgi endpoint. Specifically, the application accepts input via the ipaddr argument intended for a diagnostic ping utility. However, instead of safely parsing and validating the input against a strict IP address regex or utilizing safe API alternatives, the application concatenates the raw user-supplied parameter directly into a system command string. This string is subsequently passed to dangerous execution sinks such as the popen or system standard library functions.\nThe attack flow proceeds as follows: An external, unauthenticated attacker initiates an HTTP request targeting the exposed /cgi-bin/ping.cgi endpoint over the network. The attacker crafts a malicious payload containing command separator characters (such as semicolons, pipes, or ampersands) appended to or embedded within the ipaddr parameter. Upon receipt, the vulnerable CGI script processes the request, constructs the operating system command string containing the injected payload, and executes it via the underlying shell environment. Because the web server process typically runs with elevated privileges, the injected operating system commands are immediately executed with those same privileges.\nThe network exposure of this vulnerability is remote, as the management or diagnostic interfaces are frequently exposed to local networks or, in misconfigured environments, directly to the wider internet. No authentication or prior access privileges are required to reach the vulnerable /cgi-bin/ping.cgi script. The post-exploitation impact includes full system compromise, arbitrary code execution, reading or modifying system configuration files, persistence establishment, and potential disruption of network routing services managed by the affected device."
}