CVE-2019-13278

CRITICAL

TRENDnet TEW-827DRU Firmware <= 2.04B03 - Unauthenticated OS Command Injection via Setup Wizard

Title source: llm

Description

TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains multiple command injections when processing user input for the setup wizard, allowing an unauthenticated user to run arbitrary commands on the device. The vulnerability can be exercised on the local intranet or remotely if remote administration is enabled.

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://github.com/fuzzywalls/TRENDNetExploits/tree/master/CVE-2019-13278

Scores

CVSS v3 9.8

EPSS 0.5055

EPSS Percentile 97.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-78

Status published

Products (1)

trendnet/tew-827dru_firmware < 2.04b03

Published Jul 10, 2019

Tracked Since Feb 18, 2026