Description
A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the component Web Management Backend. The manipulation of the argument service results in os command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor confirms: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product." This vulnerability only affects products that are no longer supported by the maintainer.
Published: 2026-10-12
Score: 10 Critical
EPSS: 2.3% Low
KEV: No
Impact: Remote Command Execution via OS Command Injection
Action: Assess Impact
AI Analysis

Impact

The vulnerability stems from improper handling of input in the fwrite function of pigwidgeon.cgi within the router’s web management backend. It allows an attacker to craft data that is executed as an operating system command, leading to full remote command execution. This flaw is a classic OS command injection (CWE‑77 and CWE‑78) and could compromise confidentiality, integrity, and availability of the device and any connected networks.

Affected Systems

TRENDnet routers TEW‑751DR, TEW‑752DRU, and TEW‑733GR, specifically firmware versions 1.03B01 and 1.03B03, are impacted. These models are no longer supported by TRENDnet, and the vendor has not released a patch.

Risk and Exploitability

The CVSS score of 10 indicates critical severity. The EPSS score is 2%, indicating a low but nonzero likelihood of exploitation; the vulnerability is publicly documented and immediately exploitable via the remote web interface. The CISA KEV catalog does not list it, yet the lack of vendor support increases risk for existing deployments exposed to the Internet.

Generated by OpenCVE AI on October 12, 2026 at 14:45 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Immediately restrict or disable remote access to the router’s web management interface if possible
  • If disabling is not feasible, isolate the router on a segregated network segment and block all external traffic to its management ports
  • Apply any available firmware updates from TRENDnet; if none exist, coordinate with security vendors or consider replacing the device with a maintained model

Generated by OpenCVE AI on October 12, 2026 at 14:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 06:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the component Web Management Backend. The manipulation of the argument service results in os command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor confirms: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product." This vulnerability only affects products that are no longer supported by the maintainer.
Title TRENDnet TEW-751DR/TEW-752DRU/TEW733GR Web Management Backend pigwidgeon.cgi fwrite os command injection
First Time appeared Trendnet
Trendnet tew-751dr
Trendnet tew-752dru
Trendnet tew733gr
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:trendnet:tew-751dr:*:*:*:*:*:*:*:*
cpe:2.3:a:trendnet:tew-752dru:*:*:*:*:*:*:*:*
cpe:2.3:a:trendnet:tew733gr:*:*:*:*:*:*:*:*
Vendors & Products Trendnet
Trendnet tew-751dr
Trendnet tew-752dru
Trendnet tew733gr
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 10, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Trendnet Tew-751dr Tew-752dru Tew733gr
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-15T15:16:29.779Z

Reserved: 2026-10-11T09:41:13.126Z

Link: CVE-2026-108804

cve-icon Vulnrichment

Updated: 2026-10-15T14:54:02.967Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T06:16:59.457

Modified: 2026-10-15T16:17:37.873

Link: CVE-2026-108804

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T15:00:16Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')