PT-2021-13820 · Trendnet · Trendnet Ac2600 Tew-827Dru

Jimi Sebree · Published 2021-12-30 · Updated 2022-01-07 · CVE-2021-20165

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Trendnet AC2600 TEW-827DRU version 2.08B01

Description: The issue is related to the improper implementation of CSRF protections. Most pages lack proper usage of CSRF protections or mitigations. For pages that do use CSRF tokens, these tokens are trivially bypassable because the server does not validate them properly. This means an attacker could re-use an old token or find the token through some other method.

Recommendations: For Trendnet AC2600 TEW-827DRU version 2.08B01, consider disabling access to pages that lack proper CSRF protections or mitigations until a patch is available. Restrict the use of pages that utilize CSRF tokens to minimize the risk of exploitation, as these tokens can be bypassed. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-20165

Affected Products

Trendnet Ac2600 Tew-827Dru

References · 4

• 🔥 https://tenable.com/security/research/tra-2021-54 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-20165 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20165 · Vendor Advisory
• https://t.me/cibsecurity/34779 · Telegram Post