Trendnet TEW-657BRM OS Command Injection Vulnerability

A remote operating system command injection vulnerability has been identified in the Trendnet TEW-657BRM router, specifically in version 1.00.1. The issue arises in the 'ping_test' function of the '/setup.cgi' file, where the 'c4_IPAddr' parameter can be manipulated to inject and execute arbitrary commands on the operating system. This vulnerability is present in a product that has been discontinued and is no longer supported by the vendor.

Impact

Exploitation of this vulnerability allows for arbitrary operating system command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/setup.cgi' with the 'c4_IPAddr' parameter. Include a crafted value that exploits the command injection vulnerability, such as a command followed by a redirection operator and a file name.