PT-2019-13232 · Trendnet · Tew-827Dru

Publicado 2019-07-10 · Atualizado 2020-08-24 · CVE-2019-13278

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-827DRU versions up to and including 2.04B03

Description The issue concerns command injections when processing user input for the setup wizard, allowing an unauthenticated user to run arbitrary commands on the device. This can be exploited on the local intranet or remotely if remote administration is enabled.

Recommendations For TRENDnet TEW-827DRU versions up to and including 2.04B03, consider disabling remote administration until a patch is available to prevent remote exploitation. As a temporary workaround, restrict access to the setup wizard to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2019-13278

Produtos afetados

Tew-827Dru

Referências · 3

• 🔥 https://github.com/fuzzywalls/TRENDNetExploits/tree/master/CVE-2019-13278 · Exploit
• https://osv.dev/vulnerability/CVE-2019-13278 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-13278 · Nota de Segurança