PT-2021-13817 · Trendnet · Trendnet Ac2600 Tew-827Dru

Jimi Sebree · Published 2021-12-30 · Updated 2022-01-07 · CVE-2021-20162

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Trendnet AC2600 TEW-827DRU version 2.08B01

Description: The issue concerns the storage of credentials in plaintext. Specifically, usernames and passwords are stored in plaintext in the config files on the device, such as the file /etc/config/cameo, which contains the admin password in plaintext.

Recommendations: For version 2.08B01, consider changing the admin password and any other stored credentials to minimize the risk of exploitation, and look for updates that may address this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2021-20162

Affected Products

Trendnet Ac2600 Tew-827Dru

References · 3

• https://osv.dev/vulnerability/CVE-2021-20162 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20162 · Security Note
• https://tenable.com/security/research/tra-2021-54 · Note