PT-2024-13706 · Trendnet · Trendnet Tv-Ip1314Pi

Published 2024-01-09 · Updated 2025-06-20 · CVE-2023-49237

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TRENDnet TV-IP1314PI version 5.5.3 200714

Description An issue was discovered where command injection can occur because the system function is used by davinci to unpack language packs without strict filtering of URL strings.

Recommendations For TRENDnet TV-IP1314PI version 5.5.3 200714, consider disabling the davinci function until a patch is available to prevent command injection. Restrict access to the system function to minimize the risk of exploitation. Avoid using unfiltered URL strings in the language pack unpacking process until the issue is resolved.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2023-49237

Affected Products

Trendnet Tv-Ip1314Pi

References · 8

• 🔥 https://github.com/pcsle37/TRENDnet/blob/main/TRENDnet_vul.pdf · Exploit
• 🔥 https://drive.google.com/file/d/1lTloBkH_7zAz1ZbFVSZnfpoPd81aPaHx/view?usp=sharing · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-49237 · Security Note
• https://osv.dev/vulnerability/CVE-2023-49237 · Vendor Advisory
• https://t.me/cvenotify/67554 · Telegram Post
• https://t.me/cvenotify/126269 · Telegram Post
• https://t.me/cvenotify/66725 · Telegram Post
• https://twitter.com/CVEnew/status/1744643261522706737 · Twitter Post