PT-2021-13806 · Trendnet · Trendnet Ac2600 Tew-827Dru

Jimi Sebree · Published 2021-12-30 · Updated 2022-01-07 · CVE-2021-20151

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Trendnet AC2600 TEW-827DRU version 2.08B01

Description: The issue is related to a flaw in the session management for the device. The router's management software manages web sessions based on IP address rather than verifying client cookies or session tokens. This allows an attacker to take over an existing session, provided they can spoof or take over the original IP address of the user's session.

Recommendations: For Trendnet AC2600 TEW-827DRU version 2.08B01, consider disabling remote management or restricting access to the device's management interface until a patch is available. As a temporary workaround, restrict access to the router's management software to minimize the risk of session takeover. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2021-20151

Affected Products

Trendnet Ac2600 Tew-827Dru

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-20151 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20151 · Vendor Advisory
• https://t.me/cvenotify/25099 · Telegram Post
• https://tenable.com/security/research/tra-2021-54 · Note
• https://t.me/cibsecurity/34769 · Telegram Post