Vulnerability details
CVE-2026-108804
Trendnet TEW-751DRTrendnet TEW-752DRUTrendnet TEW733GR
TRENDnet TEW-751DR/TEW-752DRU/TEW733GR Web Management Backend pigwidgeon.cgi fwrite os command injection
CVSS 4.0
10.0Critical
Official description
A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the component Web Management Backend. The manipulation of the argument service results in os command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor confirms: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product." This vulnerability only affects products that are no longer supported by the maintainer.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 10.0Critical | 4.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P |
| 10.0Critical | 3.1 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R |
| 10.0Critical | 3.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R |
| 10.0High | 2.0 | CVEProject cvelistV5 (CNA) (VulDB) | AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Trendnet | TEW-751DR | 1.03B01 | CVEProject cvelistV5 (CNA) |
| Trendnet | TEW-751DR | 1.03B03 | CVEProject cvelistV5 (CNA) |
| Trendnet | TEW-752DRU | 1.03B01 | CVEProject cvelistV5 (CNA) |
| Trendnet | TEW-752DRU | 1.03B03 | CVEProject cvelistV5 (CNA) |
| Trendnet | TEW733GR | 1.03B01 | CVEProject cvelistV5 (CNA) |
| Trendnet | TEW733GR | 1.03B03 | CVEProject cvelistV5 (CNA) |
References and advisories
6- https://vuldb.com/submit/962770 third-party-advisory
- https://github.com/dacj4n/TRENDNetExploits exploit
- https://vuldb.com/vuln/416581 vdb-entrytechnical-description
- https://vuldb.com/vuln/416581/cti signaturepermissions-required
- https://vuldb.com/cve/CVE-2026-108804 third-party-advisory
- https://github.com/dacj4n/TRENDNetExploits/tree/main/exploit exploit
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-12
- Last updated
- 2026-10-15
- State
- Published
- Assigner (CNA)
- VulDB
- Kolun priority
- 46 · Medium
Exploit prediction (EPSS)
2.31%
Probability of exploitation in 30 days
83.5%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-78OS Command Injection
- CWE-77Command Injection