Description
A vulnerability was determined in TRENDnet TEW-713RE up to 1.02. The affected element is the function sub_421494 of the file /goform/addRouting. Executing a manipulation of the argument dest can lead to command injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-03-31
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The TEW‑713RE firmware up to version 1.02 contains a flaw in the sub_421494 function of the web interface /goform/addRouting. A crafted value for the dest parameter allows remote execution of arbitrary shell commands, compromising the device’s confidentiality, integrity, and availability. This vulnerability is a classic command injection, directly leveraging unsanitized input to gain execution rights.

Affected Systems

The affected routers are TRENDnet TEW‑713RE units running firmware 1.02 or earlier. No earlier firmware versions are mentioned, so the scope is limited to this generation of devices.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate level of risk. EPSS is below 1 % and the vulnerability is not listed in KEV, suggesting a low current exploitation rate. The likely attack vector, based on the description, is a remote connection to the router’s web interface, which may be accessible from the local or wider network. Because the vendor has not released a fix, the threat persists until a patch is applied or until the vulnerable interface is mitigated through network controls.

Generated by OpenCVE AI on May 2, 2026 at 11:01 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any newly released firmware updates for the TEW‑713RE to eliminate the command injection flaw.
  • If a patch is not yet available, enforce strict access controls by limiting the router’s web interface to trusted networks or disabling remote management entirely.
  • Configure firewall or ACL rules to block the /goform/addRouting endpoint from untrusted sources, preventing the injection vector from being reachable.
  • Monitor device logs for unusual traffic patterns targeting the /goform/addRouting endpoint and investigate any anomalies promptly.

Generated by OpenCVE AI on May 2, 2026 at 11:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 30 Apr 2026 17:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:h:trendnet:tew-713re:-:*:*:*:*:*:*:*
cpe:2.3:o:trendnet:tew-713re_firmware:1.0.2:*:*:*:*:*:*:*

Thu, 02 Apr 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Apr 2026 02:15:00 +0000

Type Values Removed Values Added
First Time appeared Trendnet tew-713re
Vendors & Products Trendnet tew-713re

Tue, 31 Mar 2026 06:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in TRENDnet TEW-713RE up to 1.02. The affected element is the function sub_421494 of the file /goform/addRouting. Executing a manipulation of the argument dest can lead to command injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Title TRENDnet TEW-713RE addRouting sub_421494 command injection
First Time appeared Trendnet
Trendnet tew-713re Firmware
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:o:trendnet:tew-713re_firmware:*:*:*:*:*:*:*:*
Vendors & Products Trendnet
Trendnet tew-713re Firmware
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Trendnet Tew-713re Tew-713re Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-02T14:59:28.115Z

Reserved: 2026-03-30T19:05:07.402Z

Link: CVE-2026-5183

cve-icon Vulnrichment

Updated: 2026-04-02T14:59:23.201Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-31T06:16:01.590

Modified: 2026-04-30T17:37:33.830

Link: CVE-2026-5183

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-02T11:15:19Z

Weaknesses