Remote Command Injection in TRENDnet Wireless Routers

A critical command injection vulnerability (CVE-2026-108804) has been identified in the web management backend of legacy TRENDnet router models, including the TEW-751DR, TEW-752DRU, and TEW733GR (versions 1.03B01/1.03B03). The vulnerability resides within the 'fwrite' function of the 'pigwidgeon.cgi' script. By providing a specifically crafted payload to the 'service' argument in an HTTP request, an unauthenticated remote attacker can achieve arbitrary OS command execution with root-level privileges. Since these devices reached end-of-life (EOL) status in 2011, the vendor has confirmed that no security patches will be released. This vulnerability is publicly disclosed and poses a significant risk to any remaining production deployments where these devices have not been decommissioned.

Impact

The vulnerability allows for unauthenticated remote code execution, effectively granting an attacker full control over the affected network device. Given that these devices are EOL and contain no mechanism for remediation, any unit exposed to the internet is susceptible to immediate compromise. Successful exploitation results in complete system compromise, enabling further lateral movement into the local area network (LAN) attached to the router.

Recommendation

• Immediately decommission and replace all instances of TRENDnet TEW-751DR, TEW-752DRU, and TEW733GR routers, as they are EOL and cannot be patched.
• Ensure that any remaining legacy network infrastructure is not exposed to the public internet by placing it behind more secure gateway devices or firewalls that can inspect and block malicious HTTP traffic.
• Implement network segmentation to isolate these devices until they are removed from the environment.
• Review perimeter firewall logs for suspicious HTTP requests targeting 'pigwidgeon.cgi' with complex query strings, which may indicate exploitation attempts.