Trendnet TEW-657BRM Command Injection Vulnerability in the Web Interface
Vulnerability
A command injection vulnerability has been identified in the Trendnet TEW-657BRM router, specifically in version 1.00.1. The issue arises in the web interface file '/setup.cgi', where the 'pcdb_list' parameter can be manipulated to inject and execute operating system commands. This vulnerability can be exploited remotely, and a public proof-of-concept exploit is available.
Impact
Exploitation of this vulnerability allows for arbitrary operating system command execution on the affected device.
Reproduction
To reproduce this vulnerability, send a POST request to '/setup.cgi' with the 'pcdb_list' parameter. Include a command injection payload, such as a command to list directory contents, redirected to a file.
Remediation
No known mitigation is available for this vulnerability.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.