The vulnerability arises from a failure to fully verify the authenticity of firmware data when the firmware update interface processes the argument dest in the new_gui_update_firmware function. This weakness, classified as CWE‑345, allows an attacker to potentially inject and install tampered firmware without proper authentication, leading to unauthorized control of the device.

Affected devices are TRENDnet TEW‑821DAP routers running firmware version 1.12B01, which support only hardware revision v1.xR. The product has been end‑of‑life for approximately eight years, and it is no longer sold or supported by TRENDnet.

The CVSS score of 6.3 indicates a moderate severity. Because the product is EOL, the practical risk is mitigated, but the absence of a publicly available patch and the fact that the exploit requires complex interaction reduce immediate threat. The EPSS score is not published, and the vulnerability is not listed in the CISA KEV catalog. A remote attacker would need to craft a specific payload that manipulates the dest argument during a firmware update session; the attack is deemed difficult and highly complex, and no evidence of active exploitation is known.