Command Injection in TRENDnet Router via /cgi-bin/ping.cgi

A high-severity command injection vulnerability, tracked as CVE-2026-75985, affects TRENDnet Router firmware version 1.1.02b01. The vulnerability is located within the /cgi-bin/ping.cgi script, which fails to properly neutralize user-supplied input provided to the wan_type argument. An attacker can leverage this flaw to achieve remote code execution on the affected device. Publicly available exploit code has been identified, significantly increasing the risk of exploitation for exposed management interfaces. Organizations using this specific firmware version should prioritize restricting access to the web management interface or updating to a patched version if available, as the ease of exploitation makes this a target for automated scanning and botnets.

Attack Chain

1. The attacker performs reconnaissance to identify internet-facing TRENDnet Router devices running version 1.1.02b01.
2. The attacker gains authenticated access to the target's web management interface (or exploits a separate bypass to reach the management endpoint).
3. The attacker crafts a malicious HTTP GET or POST request targeting /cgi-bin/ping.cgi.
4. The attacker injects shell metacharacters (e.g., ;, |, &) into the wan_type parameter of the request.
5. The underlying system's web server processes the request and passes the tainted wan_type input to a system command or script.
6. The injection triggers the execution of arbitrary system commands with the privileges of the web server process.
7. The attacker establishes persistence or exfiltrates configuration data from the device.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands on the router, potentially leading to full device compromise, network traffic interception, unauthorized access to internal network segments, and long-term persistence within the environment.

Recommendation

Prioritize the following actions to mitigate risk associated with CVE-2026-75985:

• Immediately restrict access to the web management interface of all TRENDnet routers to trusted internal IP addresses only.
• Disable remote management features if not strictly required for business operations.
• Monitor logs for HTTP requests directed at /cgi-bin/ping.cgi containing suspicious character sequences (e.g., ;, |, &) in the wan_type parameter.
• Deploy the provided Sigma rule to web server or proxy logs to detect exploitation attempts.