TRENDnet TEW-713RE Command Injection Vulnerability in Routing Management

A command injection vulnerability has been identified in the TRENDnet TEW-713RE router, specifically in version 1.02. The issue arises in the '/goform/addRouting' endpoint, where the 'dest' parameter can be manipulated to inject and execute arbitrary commands. This vulnerability can be exploited remotely, and a public proof-of-concept is available.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/goform/addRouting' with a 'dest' parameter that is crafted to overflow the buffer and inject a command. The injected command will be executed on the router, demonstrating the command injection flaw.