PT-2021-13811 · Trendnet · Trendnet Ac2600 Tew-827Dru

Jimi Sebree · Published 2021-12-30 · Updated 2022-01-07 · CVE-2021-20156

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Trendnet AC2600 TEW-827DRU version 2.08B01

Description: The issue is related to an improper access control configuration that could allow for a malicious firmware update. It is possible to manually install firmware that may be malicious in nature as there does not appear to be any signature validation done to determine if it is from a known and trusted source. This includes firmware updates that are done via the automated "check for updates" in the admin interface. If an attacker is able to masquerade as the update server, the device will not verify that the firmware updates downloaded are legitimate.

Recommendations: For Trendnet AC2600 TEW-827DRU version 2.08B01, as a temporary workaround, consider disabling the automated "check for updates" feature in the admin interface until a patch is available. Restrict access to the firmware update mechanism to minimize the risk of exploitation. Avoid using untrusted sources for firmware updates. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2021-20156

Affected Products

Trendnet Ac2600 Tew-827Dru

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-20156 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20156 · Vendor Advisory
• https://tenable.com/security/research/tra-2021-54 · Note
• https://t.me/cvenotify/25105 · Telegram Post
• https://t.me/cibsecurity/34786 · Telegram Post