CVE-2025-15136
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk96th percentile - higher than 96% of all known CVEs
Summary
A vulnerability in TRENDnet TEW-800MB (version 1.0.1.0) affects the function do_setWizard_asp in the file /goform/wizardset of the Management Interface component. Manipulation of the WizardConfigured argument leads to command injection. The attack can be remote, the exploit is public, and the vendor did not respond.
Risk Assessment
Remote command execution on the router, potentially allowing takeover of the device and network. The public exploit increases the risk of exploitation.
Recommendation
Check for vendor updates. If none, consider disconnecting the device from the network or restricting access to the administrative panel.
Other vulnerabilities in TRENDnet TEW-800MB
Original NVD description (English source)
A security vulnerability has been detected in TRENDnet TEW-800MB 1.0.1.0. Affected is the function do_setWizard_asp of the file /goform/wizardset of the component Management Interface. The manipulation of the argument WizardConfigured leads to command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS