The TEW-823DRU firmware version 1.1.02b01 contains a command injection flaw in the nvram_get function of the CLI Configuration Tool. The flaw is a classic input validation failure that allows an attacker to inject arbitrary shell commands through crafted input strings, resulting in remote execution of commands on the device. Since the CLI tool is exposed over the network, the vulnerability permits attackers to compromise the system without needing local access.

Affected devices are TRENDnet TEW-823DRU routers running firmware 1.1.02b01. No patched versions have been identified in the supplied data; vendors should verify if a newer build incorporates the fix. The vulnerability is specific to the TEW-823DRU model, as indicated by the CPE entry.

The CVSS score is 5.1, classifying it as medium severity, while the EPSS score is unavailable and it has not been listed in CISA’s KEV catalog. However, public proof‑of‑concept exploits are available, showing that the attack is feasible remotely. Attackers can exploit the vulnerability by sending specially crafted requests to the CLI interface, potentially gaining arbitrary command execution and full control over the device.