TRENDnet TEW-713RE Command Injection Vulnerability in setSysAdm Function

A command injection vulnerability has been identified in the TRENDnet TEW-713RE router, specifically in version 1.02. The issue arises in the file '/goform/setSysAdm', where the 'admuser' parameter can be manipulated to inject commands. This vulnerability can be exploited remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/goform/setSysAdm' with the 'admuser' parameter. Include a command payload, such as a list command followed by a redirection to a file, to demonstrate the command injection. The request should be sent with basic authentication using admin credentials.