PT-2023-7915 · Trendnet · Trendnet Tew-652Brp

Leetsun · Published 2023-02-01 · Updated 2024-05-17 · CVE-2023-0611

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-652BRP version 3.04B01

Description A critical issue has been found in the Web Management Interface of the TRENDnet TEW-652BRP, specifically in the file get set.ccp. This issue leads to command injection, allowing a remote attacker to execute arbitrary code. The exploit has been disclosed to the public and may be used. The attack may be initiated remotely.

Recommendations For TRENDnet TEW-652BRP version 3.04B01, as a temporary workaround, consider disabling the Web Management Interface until a patch is available. Restrict access to the get set.ccp file to minimize the risk of exploitation. Avoid using the Web Management Interface remotely until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2023-08990

CVE-2023-0611

Affected Products

Trendnet Tew-652Brp

References · 8

• 🔥 https://vuldb.com/?id.219935 · Exploit
• https://bdu.fstec.ru/vul/2023-08990 · Security Note
• https://osv.dev/vulnerability/CVE-2023-0611 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0611 · Security Note
• https://t.me/cibsecurity/57296 · Telegram Post
• https://vuldb.com/?ctiid.219935 · Note
• https://twitter.com/vuldb/status/1717382553370571139 · Twitter Post
• https://t.me/cvenotify/43307 · Telegram Post