PT-2021-13804 · Trendnet · Trendnet Ac2600 Tew-827Dru

Published 2021-12-30 · Updated 2022-01-07 · CVE-2021-20149

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Trendnet AC2600 TEW-827DRU version 2.08B01

Description: The issue concerns insufficient access controls for the WAN interface. Specifically, the default iptables ruleset only applies to IPv4, leaving all services running on the device accessible via the WAN interface via IPv6 by default.

Recommendations: For Trendnet AC2600 TEW-827DRU version 2.08B01, consider updating the iptables ruleset to include IPv6 restrictions, ensuring that access to services on the device is properly controlled across both IPv4 and IPv6 protocols. As a temporary workaround, restrict access to the WAN interface via IPv6 to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2021-20149

Affected Products

Trendnet Ac2600 Tew-827Dru

References · 4

• https://osv.dev/vulnerability/CVE-2021-20149 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20149 · Security Note
• https://tenable.com/security/research/tra-2021-54 · Note
• https://t.me/cvenotify/25094 · Telegram Post