CVE-2026-76591
HighCVSS 7.4Exploitation Probability (EPSS)
Elevated risk69th percentile - higher than 69% of all known CVEs
Summary
In TRENDnet TEW-755AP up to 20260702, the log_email_server function in /cgi-bin/email.cgi of the ssi component is vulnerable to command injection. The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
An attacker can remotely execute arbitrary commands on the device, potentially leading to device compromise or network breach.
Recommendation
Update the device firmware to the latest version or apply available security patches.
Other vulnerabilities in TRENDnet TEW-755AP
See all- CVE-2026-76590Critical
A vulnerability was identified in TRENDnet TEW-755AP up to 20260702. Affected by this issue is some unknown functionality of the file /cgi-bin/wan.cgi of the component ssi. Such manipulation of the argument cameo.wan.wan_pppoe_password_00 leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.
- CVE-2026-76589Critical
A vulnerability was found in TRENDnet TEW-755AP up to 20260702. Affected is the function FUN_401000 of the file /sbin/mycli. The manipulation of the argument ssid results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.
Original NVD description (English source)
A security flaw has been discovered in TRENDnet TEW-755AP up to 20260702. This affects the function log_email_server of the file /cgi-bin/email.cgi of the component ssi. Performing a manipulation results in command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.