Description

A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. This vulnerability affects the function nvram_get of the component CLI Configuration Tool. This manipulation causes command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-08-22T12:16:25.817Z",
  "pubdate": "2026-08-22T12:16:25.817Z",
  "executiveSummary": "A remote command injection vulnerability has been identified within the CLI Configuration Tool component of the TRENDnet TEW-823DRU router running firmware version 1.1.02b01.\nThe flaw specifically resides in the nvram_get function, which improperly sanitizes user-supplied input before passing it to the underlying operating system shell for execution.\nSuccessful exploitation of this vulnerability allows an unauthenticated remote attacker to execute arbitrary system commands with elevated privileges on the affected device.\nThe realization of this risk leads to total compromise of the affected router, potentially enabling malicious actors to intercept network traffic, modify device configurations, pivot to internal network segments, or utilize the compromised device in botnet operations.\nPublicly available exploits increase the probability of active exploitation in the wild, necessitating immediate defensive measures for exposed systems.",
  "technicalDetails": "The vulnerability is classified as an OS command injection flaw affecting the CLI Configuration Tool component of the TRENDnet TEW-823DRU router, specifically within firmware version 1.1.02b01.\nThe root cause of the vulnerability stems from insecure coding practices within the nvram_get function, where parameters derived from user input are concatenated directly into strings executed by the system shell without adequate validation, filtering, or escaping mechanisms.\nAttackers can leverage network exposure to interact with the vulnerable service remotely.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious payload containing shell metacharacters or command separators (such as semicolons, pipe symbols, or backticks) appended to input parameters processed by the nvram_get function. Second, the vulnerable CLI Configuration Tool component receives the untrusted input over the network interface. Third, the application passes the unsanitized input directly to the underlying operating system execution routines. Finally, the operating system shell parses the injected commands, executing them with the privilege level of the running process, which is typically root on embedded consumer routers.\nBecause the vulnerability can be triggered remotely without prior authentication or high-level privilege requirements, it presents a severe attack surface exposure.\nPost-exploitation impact includes arbitrary code execution, complete loss of device integrity, unauthorized access to local network resources, and potential persistence mechanisms established via firmware tampering or configuration modifications."
}