Description
A security flaw has been discovered in TRENDnet TEW-755AP up to 20260702. This affects the function log_email_server of the file /cgi-bin/email.cgi of the component ssi. Performing a manipulation results in command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
Published: 2026-08-19
Score: 5.3 Medium
EPSS: 1.3% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a command‑injection flaw in the log_email_server function of the /cgi-bin/email.cgi component of the TRENDnet TEW‑755AP router firmware. Manipulating input to that function lets an attacker issue arbitrary system commands, giving remote code execution capability. The flaw originates from insufficient input validation (CWE‑74) and the unsanitized use of user data in command execution (CWE‑77).

Affected Systems

Affecting TRENDnet TEW‑755AP routers carrying firmware up to 20260702, the log_email_server function is exposed through the router’s web‑management CGI interface, making the vulnerability reachable from any host that can access that interface, including external internet hosts.

Risk and Exploitability

With a CVSS score of 5.3, the flaw carries moderate severity, and no EPSS score is available while it is not listed in CISA’s KEV catalog. Nonetheless, a publicly available exploit and a remote attack vector mean that exposed routers could be compromised when attackers use the known exploitation code, raising the risk until a vendor patch is applied.

Generated by OpenCVE AI on August 20, 2026 at 07:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Verify the firmware version and upgrade to the latest official TRENDnet firmware that includes the fix for the log_email_server command‑injection flaw.
  • If a patch is not yet available, limit access to the /cgi-bin/email.cgi endpoint by blocking external traffic or disabling remote management outside the trusted LAN.
  • Apply network segmentation or firewall rules to ensure only trusted internal hosts can reach the router’s web‑configuration ports.
  • If customizing firmware, enforce strict input sanitization for any parameters that interact with the log_email_server function to mitigate further injection attempts.

Generated by OpenCVE AI on August 20, 2026 at 07:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
First Time appeared Trendnet tew-755ap
Vendors & Products Trendnet tew-755ap

Wed, 19 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in TRENDnet TEW-755AP up to 20260702. This affects the function log_email_server of the file /cgi-bin/email.cgi of the component ssi. Performing a manipulation results in command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
Title TRENDnet TEW-755AP ssi email.cgi log_email_server command injection
First Time appeared Trendnet
Trendnet tew-755ap Firmware
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:o:trendnet:tew-755ap_firmware:*:*:*:*:*:*:*:*
Vendors & Products Trendnet
Trendnet tew-755ap Firmware
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P'}

Subscriptions

Trendnet Tew-755ap Tew-755ap Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-19T22:00:11.212Z

Reserved: 2026-08-19T14:38:06.124Z

Link: CVE-2026-76591

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-08-19T22:17:27.787

Modified: 2026-08-20T12:48:10.287

Link: CVE-2026-76591

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T08:00:03Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')