Description
A vulnerability was found in TRENDnet TEW-821DAP 2.2.01b05. Affected is an unknown function of the file /cgi-bin/upload.cgi of the component ssi. Performing a manipulation of the argument filename results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used.
Published: 2026-08-22
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A known weakness in the TRENDnet TEW‑821DAP firmware allows remote attackers to exploit a function within the upload.cgi component that accepts a filename parameter. Manipulation of this parameter can lead to command injection, enabling arbitrary shell commands to be executed on the router. This vulnerability falls under the command injection flaws classified as CWE‑74 and CWE‑77.

Affected Systems

The flaw affects the TRENDnet TEW‑821DAP wireless access‑point running firmware version 2.2.01b05. Only devices with this firmware version and the default configuration that exposes the /cgi-bin/upload.cgi endpoint are vulnerable.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, while the EPSS score is unavailable, suggesting limited known exploitation activity. The vulnerability is not listed in CISA’s KEV catalog. The exploit can be triggered remotely over the network via a crafted HTTP request to /cgi-bin/upload.cgi, with the attacker supplying a malicious filename. Because the attack vector is publicly documented and the exploit has been released, the risk remains elevated for exposed devices.

Generated by OpenCVE AI on August 22, 2026 at 12:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the device firmware to a revision that patches the upload.cgi command injection.
  • If an upgrade is not feasible, isolate the device by placing it in a separate VLAN or applying firewall rules that block inbound access to /cgi-bin/upload.cgi from untrusted networks.
  • Regularly monitor device logs and network traffic for suspicious upload requests or unexpected command executions.

Generated by OpenCVE AI on August 22, 2026 at 12:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 22 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Trendnet tew-821dap
Vendors & Products Trendnet tew-821dap

Sat, 22 Aug 2026 11:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in TRENDnet TEW-821DAP 2.2.01b05. Affected is an unknown function of the file /cgi-bin/upload.cgi of the component ssi. Performing a manipulation of the argument filename results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used.
Title TRENDnet TEW-821DAP ssi upload.cgi command injection
First Time appeared Trendnet
Trendnet tew-821dap Firmware
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:o:trendnet:tew-821dap_firmware:*:*:*:*:*:*:*:*
Vendors & Products Trendnet
Trendnet tew-821dap Firmware
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P'}

Subscriptions

Trendnet Tew-821dap Tew-821dap Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-22T10:45:09.511Z

Reserved: 2026-08-21T18:41:56.089Z

Link: CVE-2026-77945

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-22T11:16:53.243

Modified: 2026-08-22T11:16:53.243

Link: CVE-2026-77945

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-22T12:30:16Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')