Description

A vulnerability was found in TRENDnet TEW-821DAP 2.2.01b05. Affected is an unknown function of the file /cgi-bin/upload.cgi of the component ssi. Performing a manipulation of the argument filename results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-22T11:16:53.243Z",
  "pubdate": "2026-08-22T11:16:53.243Z",
  "executiveSummary": "A critical command injection vulnerability has been identified in the TRENDnet TEW-821DAP wireless access point running firmware version 2.2.01b05. The flaw resides within the ssi component, specifically inside the /cgi-bin/upload.cgi script, which fails to properly sanitize user-supplied input.\nBy manipulating the filename parameter during an upload operation, an unauthenticated remote attacker can inject arbitrary operating system commands that are subsequently executed with the privileges of the underlying web server or system shell.\nSuccessful exploitation of this vulnerability leads to remote code execution, granting the adversary full system compromise, potential unauthorized access to the network, and loss of device integrity.\nGiven that public exploit code is actively available, the risk to exposed systems is critical. Immediate remediation is required to prevent unauthorized remote exploitation.",
  "technicalDetails": "The vulnerability is a classic command injection flaw originating in the file /cgi-bin/upload.cgi, which is managed by the ssi component of the TRENDnet TEW-821DAP firmware version 2.2.01b05.\nThe root cause of the vulnerability lies in insecure input handling where parameters supplied via HTTP requests—specifically the filename argument—are passed directly to underlying system APIs or shell execution functions without adequate sanitization, validation, or escaping.\nThe attack vector is network-based, allowing remote adversaries to initiate the attack without requiring prior authentication or localized access, provided the vulnerable endpoint is exposed to the network.\nThe exploitation flow proceeds as follows: First, the attacker crafts a malicious HTTP POST or multipart request targeting the /cgi-bin/upload.cgi endpoint. Second, the attacker injects malicious shell metacharacters and operating system commands into the filename argument within the request headers or body. Third, the ssi component processes the input and unsafely interpolates the tainted filename into a system shell command execution context. Finally, the operating system executes the injected command sequence with the privilege level associated with the web application daemon, resulting in arbitrary code execution.\nPost-exploitation impact includes complete administrative control over the affected TRENDnet TEW-821DAP device, capability to pivot into internal network segments, interception of wireless traffic, and persistence establishment on the compromised hardware."
}