Description

A security flaw has been discovered in TRENDnet TEW-755AP up to 20260702. This affects the function log_email_server of the file /cgi-bin/email.cgi of the component ssi. Performing a manipulation results in command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-19T22:17:27.787Z",
  "pubdate": "2026-08-19T22:17:27.787Z",
  "executiveSummary": "A critical security flaw has been identified in the TRENDnet TEW-755AP wireless access point, specifically affecting versions up to 20260702. The vulnerability exists within the ssi component, specifically inside the log_email_server function exposed via the /cgi-bin/email.cgi binary. This flaw manifests as a remote command injection vulnerability, allowing an unauthenticated remote attacker to execute arbitrary system commands on the underlying operating system.\nThe risk implications are severe, as successful exploitation could lead to complete system compromise, unauthorized access to sensitive network environments, and potential lateral movement. Since a public exploit has been released, the threat landscape is elevated, requiring immediate remediation attention from network administrators. Attackers can carry out this exploitation remotely without requiring prior authentication, provided they can reach the administrative interface or affected CGI endpoint.",
  "technicalDetails": "The vulnerability is rooted in insecure input handling within the log_email_server function located in /cgi-bin/email.cgi of the ssi component on TRENDnet TEW-755AP devices up to version 20260702. The root cause stems from the improper sanitization or validation of user-supplied parameters passed to the email configuration backend. Specifically, parameters processed by log_email_server are unsafely concatenated or passed directly into system shell execution functions, such as system() or popen(), without adequate escaping.\nThe attack flow begins when a remote adversary crafts a malicious HTTP request directed at /cgi-bin/email.cgi. The attacker injects shell metacharacters, such as semicolons, pipe symbols, or backticks, combined with operating system commands into the vulnerable parameters processed by the log_email_server function. When the binary executes, the underlying shell interprets these injected characters, leading to the execution of arbitrary commands with the privilege level of the web server or underlying daemon, which is often root in embedded router environments.\nNetwork exposure is significant as the attack vector is accessible remotely over the network. Authentication and privilege requirements are minimal or absent depending on the specific firmware implementation and access controls, enabling remote attackers to execute code without valid credentials. The payload behavior involves direct execution of injected shell commands, which can facilitate reverse shells, downloading malicious payloads, modifying system configurations, or facilitating further network compromise. Because a public exploit is available, automated or manual exploitation can be performed easily by malicious actors."
}