A flaw in the Edit function of Trendnet TEW-657BRM’s /setup.cgi allows an attacker to supply a manipulated pcdb_list argument that is executed on the device’s operating system. This enables arbitrary command execution on the device, potentially granting full control over the router including access to its configuration, stored credentials and the possibility of pivoting to other network assets.

The vulnerability is limited to the Trendnet TEW-657BRM model running firmware version 1.00.1. The device has been end‑of‑life and no longer supported by the vendor since June 2011. No other versions or models are listed as affected.

The CVSS score of 5.3 indicates a moderate risk, while an EPSS of 1% denotes a low probability of exploitation in the general population. The vulnerability is not recorded in the CISA KEV catalog. Exploitation requires remote access to the device’s web interface; because the device is discontinued, the window of opportunity depends on the presence of the unit in an active network environment. Without a vendor patch, the only mitigation is to eliminate or isolate the device from external exposure.