{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3htrendnettew-751dr1.03b03/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:h:trendnet:tew-751dr:1.03b01:*:*:*:*:*:*:*","cpe:2.3:h:trendnet:tew-751dr:1.03b03:*:*:*:*:*:*:*","cpe:2.3:h:trendnet:tew-752dru:1.03b01:*:*:*:*:*:*:*","cpe:2.3:h:trendnet:tew-752dru:1.03b03:*:*:*:*:*:*:*","cpe:2.3:h:trendnet:tew733gr:1.03b01:*:*:*:*:*:*:*","cpe:2.3:h:trendnet:tew733gr:1.03b03:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":10,"id":"CVE-2026-108804"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["TEW-751DR (1.03B01/1.03B03)","TEW-752DRU (1.03B01/1.03B03)","TEW733GR (1.03B01/1.03B03)"],"_cs_severities":["critical"],"_cs_tags":["remote-code-execution","command-injection","network-infrastructure","eol-device"],"_cs_type":"advisory","_cs_vendors":["TRENDnet"],"content_html":"\u003cp\u003eA critical command injection vulnerability (CVE-2026-108804) has been identified in the web management backend of legacy TRENDnet router models, including the TEW-751DR, TEW-752DRU, and TEW733GR (versions 1.03B01/1.03B03). The vulnerability resides within the 'fwrite' function of the 'pigwidgeon.cgi' script. By providing a specifically crafted payload to the 'service' argument in an HTTP request, an unauthenticated remote attacker can achieve arbitrary OS command execution with root-level privileges. Since these devices reached end-of-life (EOL) status in 2011, the vendor has confirmed that no security patches will be released. This vulnerability is publicly disclosed and poses a significant risk to any remaining production deployments where these devices have not been decommissioned.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows for unauthenticated remote code execution, effectively granting an attacker full control over the affected network device. Given that these devices are EOL and contain no mechanism for remediation, any unit exposed to the internet is susceptible to immediate compromise. Successful exploitation results in complete system compromise, enabling further lateral movement into the local area network (LAN) attached to the router.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately decommission and replace all instances of TRENDnet TEW-751DR, TEW-752DRU, and TEW733GR routers, as they are EOL and cannot be patched.\u003c/li\u003e\n\u003cli\u003eEnsure that any remaining legacy network infrastructure is not exposed to the public internet by placing it behind more secure gateway devices or firewalls that can inspect and block malicious HTTP traffic.\u003c/li\u003e\n\u003cli\u003eImplement network segmentation to isolate these devices until they are removed from the environment.\u003c/li\u003e\n\u003cli\u003eReview perimeter firewall logs for suspicious HTTP requests targeting 'pigwidgeon.cgi' with complex query strings, which may indicate exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T08:08:02Z","date_published":"2026-10-12T08:08:02Z","id":"https://feed.craftedsignal.io/briefs/2026-10-trendnet-rce/","summary":"An unauthenticated remote command injection vulnerability in the web management backend of legacy TRENDnet routers allows arbitrary OS command execution via manipulated arguments to pigwidgeon.cgi.","title":"Remote Command Injection in TRENDnet Wireless Routers","url":"https://feed.craftedsignal.io/briefs/2026-10-trendnet-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:h:trendnet:tew-751dr:1.03b03:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}