TRENDnet TEW-657BRM Command Injection Vulnerability in WPS Client Setup Function

A command injection vulnerability has been identified in the TRENDnet TEW-657BRM router, specifically in version 1.00.1. The issue arises in the 'add_wps_client' function within the '/setup.cgi' file, where the 'wl_enrolee_pin' parameter is processed. This vulnerability allows for remote execution of operating system commands by injecting malicious input into the 'wl_enrolee_pin' argument, which is then executed without proper validation. The router model has been discontinued and is no longer supported by the vendor.

Impact

Exploitation of this vulnerability allows for arbitrary operating system command execution on the affected device.

Reproduction

The vulnerability can be reproduced by sending a POST request to '/setup.cgi' with the 'wl_enrolee_pin' parameter. The injected command will be executed on the router's operating system.