The vulnerability lies in the vpn_connect handler of the setup.cgi script on the Trendnet TEW‑657BRM. By manipulating the policy_name argument an attacker can execute arbitrary OS commands on the device, which effectively grants remote code execution. The flaw is a classic OS command injection, matching CWE‑77 and CWE‑78, and allows a remote adversary to compromise the router’s confidentiality, integrity, and availability.

The affected device is the Trendnet TEW‑657BRM running firmware 1.00.1. This model was discontinued and reached end‑of‑life in 2011, and the vendor no longer provides support or updates for it.

The CVSS score of 5.3 places the issue in the medium severity range, while the EPSS of 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, yet published exploits exist, implying that an attacker can trigger the flaw over a remote connection. Because the device is unsupported, patching is impossible, leaving the risk largely unmitigated unless the device is removed from or isolated within the network.