An OS command injection flaw has been discovered in the ping_test function of the setup.cgi file on the Trendnet TEW-657BRM router. By manipulating the c4_IPAddr argument, an attacker can inject arbitrary shell commands, which the device executes with privileges of its operating system. This vulnerability allows a remote adversary to run any command on the device, potentially compromising full control, leaking network configuration or internal traffic, and enabling further lateral movement.

The vulnerability affects only the Trendnet TEW-657BRM model running firmware version 1.00.1. The manufacturer has discontinued this product and ended support since June 2011, meaning no official security updates are available for it.

With a CVSS score of 5.3 and an EPSS rate of 1 %, the risk is considered moderate but non‑negligible. The flaw is remotely exploitable over the network and a public proof‑of‑concept has been released, indicating that exploitation is straightforward for an attacker with network access. As the device is no longer supported, no vendor patch exists and the vulnerability remains exploitable if the device stays online.