Description
A vulnerability was found in TRENDnet TN-200 1.02b02. It has been declared as problematic. This vulnerability affects unknown code of the component Lighttpd. The manipulation of the argument secdownload.secret with the input neV3rUseMe leads to use of hard-coded cryptographic key . The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
References (4)
Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry
technical-description
https://vuldb.com/?id.319264
Permissions Required, VDB Entry signature
permissions-required
https://vuldb.com/?ctiid.319264
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.624555
Third Party Advisory exploit
https://www.notion.so/23f54a1113e7801e944ec65a2f7c5448
Scores
CVSS v3
3.7
EPSS
0.0044
EPSS Percentile
34.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-320
CWE-321
Status
published
Products (1)
trendnet/tn-200_firmware
1.02b02
Published
Aug 09, 2025
Tracked Since
Feb 18, 2026