PT-2024-1406 · Trendnet · Trendnet Tew-824Dru

Published 2024-01-26 · Updated 2024-03-05 · CVE-2024-22545

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-824DRU version 1.04b01

Description An issue in the TRENDnet TEW-824DRU allows unauthenticated attackers to execute arbitrary code via the system.ntp.server parameter in the sub 420AE0() function. The attack can be launched remotely. This is related to insufficient argument checking in the sub 420AE0() function, which can be exploited by a remote attacker to execute arbitrary code.

Recommendations For TRENDnet TEW-824DRU version 1.04b01, consider disabling the sub 420AE0() function or restricting access to the system.ntp.server parameter until a patch is available. Avoid using the system.ntp.server parameter in the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2024-00875

CVE-2024-22545

Affected Products

Trendnet Tew-824Dru

References · 9

• 🔥 https://warp-desk-89d.notion.site/TEW-824DRU-e7228d462ce24fa1a9fecb0bee57caad · Exploit
• https://bdu.fstec.ru/vul/2024-00875 · Security Note
• https://osv.dev/vulnerability/CVE-2024-22545 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22545 · Security Note
• https://vuldb.com/?id.252125 · Note
• https://t.me/cvenotify/69848 · Telegram Post
• https://t.me/cvenotify/68797 · Telegram Post
• https://t.me/cvenotify/73033 · Telegram Post
• https://t.me/cvenotify/69291 · Telegram Post