The vulnerability resides in the /goform/setSysAdm endpoint of TRENDnet TEW-713RE firmware versions up to 1.02. It allows an unauthenticated attacker to supply a crafted admuser argument that causes the device to execute arbitrary shell commands. This command injection can lead to remote code execution, potentially compromising the confidentiality, integrity, and availability of the device and associated network resources.

The affected product is TRENDnet TEW-713RE running firmware version 1.02 or earlier. No other vendors or products are listed as vulnerable. The flaw applies to all units with the specified firmware, regardless of network configuration, as long as the management interface is reachable.

The CVSS score of 5.3 rates this issue as moderate severity; no EPSS score is available, so the probability of exploitation remains uncertain. Public exploits are known, and the attack can be launched remotely over the network by sending a specially crafted request to /goform/setSysAdm. The flaw is not included in CISA’s KEV catalog. Successful exploitation requires no authentication and relies solely on network connectivity to the device’s management interface.