PT-2021-13815 · Trendnet · Trendnet Ac2600 Tew-827Dru

Jimi Sebree · Published 2021-12-30 · Updated 2022-07-12 · CVE-2021-20160

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Trendnet AC2600 TEW-827DRU version 2.08B01

Description: The device contains a command injection issue in the smb functionality. The username parameter used when configuring smb functionality is vulnerable to command injection as root.

Recommendations: For Trendnet AC2600 TEW-827DRU version 2.08B01, consider disabling the smb functionality until a patch is available to prevent command injection attacks. Restrict access to the smb configuration to minimize the risk of exploitation. Avoid using the username parameter in the affected smb functionality until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-20160

Affected Products

Trendnet Ac2600 Tew-827Dru

References · 5

• 🔥 https://tenable.com/security/research/tra-2021-54 · Exploit
• https://osv.dev/vulnerability/CVE-2021-20160 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20160 · Security Note
• https://t.me/cvenotify/25107 · Telegram Post
• https://t.me/cibsecurity/34773 · Telegram Post