CVE-2024-28353
HIGHTRENDnet TEW-827DRU Firmware 2.10B01 - OS Command Injection via usapps.config.smb_admin_name Parameter
Title source: llmDescription
There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. An attacker can inject commands into the post request parameters usapps.config.smb_admin_name in the apply.cgi interface, thereby gaining root shell privileges.
References (1)
Core 1
Core References
Exploit, Third Party Advisory
https://warp-desk-89d.notion.site/TEW-827DRU-5c40fb20572148f0b00f329d69273791
Scores
CVSS v3
8.8
EPSS
0.0489
EPSS Percentile
89.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
total
Details
CWE
CWE-77
Status
published
Products (1)
trendnet/tew-827dru_firmware
2.10b01
Published
Mar 15, 2024
Tracked Since
Feb 18, 2026