PT-2024-2329 · Trendnet · Trendnet Tew-827Dru

CVE-2024-28354

·

Published

2024-02-26

·

Updated

2024-08-02

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions TRENDnet TEW-827DRU router version 2.10B01
Description The issue is related to a command injection vulnerability in the apply.cgi interface. An attacker can inject commands into the post request parameters usapps.@smb[%d].username, potentially gaining root shell privileges. This vulnerability may allow a remote attacker to elevate their privileges and execute arbitrary commands.
Recommendations For version 2.10B01, as a temporary workaround, consider disabling the apply.cgi interface until a patch is available. Restrict access to the usapps.@smb[%d].username parameter in the apply.cgi interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-78CWE-77

Related Identifiers

BDU:2024-02271
CVE-2024-28354

Affected Products

Trendnet Tew-827Dru