CVE-2026-15485
MediumCVSS 6.3Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
A flaw in TRENDnet TEW-821DAP version 1.11B03 allows OS command injection via the sub_43F2C4 function in /goform/tools_nslookup. The attack is remotely exploitable by manipulating the nslookup_target or dns_server arguments. The vendor states the device is end-of-life (EOL) and will not receive patches.
Risk Assessment
The organization risks remote compromise of the device, potentially leading to network breaches, data exfiltration, or lateral movement within the infrastructure.
Recommendation
Immediately decommission all TRENDnet TEW-821DAP devices and replace them with supported hardware. If replacement is not feasible, isolate them from the production network and restrict access to trusted hosts only.
Other vulnerabilities in TRENDnet TEW-821DAP
See all- CVE-2026-77946Critical
A vulnerability was found in TRENDnet TEW-821DAP 2.2.01b05 in the uci_safe_get function of /cgi-bin/apply_time.cgi in the NTP Timezone Configuration Handler. Manipulating the system.ntp.server, system.ntp.enable_server, cameo.time.time_zone, and cameo.cameo.syslog_server arguments leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2026-77945High
A vulnerability was found in TRENDnet TEW-821DAP 2.2.01b05 in an unknown function of /cgi-bin/upload.cgi in the ssi component. Manipulating the filename argument results in command injection. The attack can be initiated remotely, and the exploit has been made public.
- CVE-2026-76582High
In TRENDnet TEW-821DAP version 2.2.01b05, a command injection vulnerability exists in the popen/system function of the file /cgi-bin/ping.cgi in the ssi component. Manipulating the ipaddr argument can lead to command injection. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2026-15487Medium
A vulnerability was found in TRENDnet TEW-821DAP version 1.11B03, affecting the function sub_41FBD0 in the file /goform/system_ntp. Remote manipulation of the Hostname argument allows OS command injection. The vendor states the device is end-of-life (EOL) and will not receive patches.
- CVE-2026-15486Medium
A vulnerability was found in TRENDnet TEW-821DAP firmware version 1.11B03, allowing OS command injection via the hostname, username, and password parameters in the /goform/tools_ddns file. The attack can be performed remotely, and the vendor states the device is end-of-life (EOL).
- CVE-2026-15484High
A buffer overflow vulnerability was found in the TRENDnet TEW-821DAP version 1.12B01 in the sub_41EC14 function of the /goform/tools_nslookup file within the ssi component. The attack can be launched remotely. The vendor states the device is End-of-Life (EOL) and will not be patched.
- CVE-2026-15483High
A buffer overflow vulnerability has been detected in TRENDnet TEW-821DAP version 1.12B01 in the sub_41EC14 function of the /goform/tools_nslookup file within the ssi component. An attacker can remotely exploit this by manipulating the nslookup_target argument. The vendor states the device is End-of-Life (EOL) and will not issue patches.
- CVE-2023-51148High
An issue in TRENDnet AC1200 Dual Band PoE Indoor Wireless Access Point TEW-821DAP v.3.00b06 allows an attacker to execute arbitrary code via the 'mycli' command-line interface component.
Original NVD description (English source)
A flaw has been found in TRENDnet TEW-821DAP 1.11B03. The impacted element is the function sub_43F2C4 of the file /goform/tools_nslookup of the component DNS Lookup Handler. This manipulation of the argument nslookup_target/dns_server causes os command injection. The attack can be initiated remotely. The vendor explains: "We are unable to confirm the existence of the vulnerabilities for (...) TEW-821DAP (v1.0R) as these items have been EOL. " This vulnerability only affects products that are no longer supported by the maintainer.