CVE-2025-15137
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk96th percentile - higher than 96% of all known CVEs
Summary
A vulnerability was detected in TRENDnet TEW-800MB (version 1.0.1.0) in the function sub_F934 of the file NTPSyncWithHost.cgi. The manipulation results in command injection. The attack can be launched remotely, and the exploit is public. The vendor did not respond to contact.
Risk Assessment
Remote execution of arbitrary commands on the device, potentially leading to full compromise of the router and network. The public exploit increases the risk of attack.
Recommendation
Check if the vendor has released a firmware update. If not, consider decommissioning the device or restricting access from external networks.
Other vulnerabilities in TRENDnet TEW-800MB
Original NVD description (English source)
A vulnerability was detected in TRENDnet TEW-800MB 1.0.1.0. Affected by this vulnerability is the function sub_F934 of the file NTPSyncWithHost.cgi. The manipulation results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS