The vulnerability permits remote attackers to inject arbitrary operating‑system commands into the DNS Lookup Handler of TRENDnet TEW‑821DAP firmware through unsanitized nslookup_target and dns_server parameters. This command injection flaw, classified as CWE‑77 and CWE‑78, allows execution of any command with the device’s privileges, compromising confidentiality, integrity, and potentially the broader network. The flaw is not included in the CISA KEV catalog, and the consumer probe that the vendor has released confirms that the affected firmware is EOL and no longer supported.

The affected product is TRENDnet TEW‑821DAP model 1.11B03. The firmware is end‑of‑life and no longer maintained by the vendor. The flaw exists in the sub_43F2C4 function of the /goform/tools_nslookup component, and the vendor confirms that earlier unsupported firmware versions may also be affected.

The CVSS score of 5.3 denotes medium severity, while the EPSS score of 1% indicates a very low current exploitation probability. The flaw is remote and can be triggered via a crafted HTTP request to the /goform/tools_nslookup endpoint. If an attacker succeeds, they can run arbitrary OS commands on the device, gaining full control over the compromised appliance and potentially compromising the wider network.