CVE-2025-10107
BaseFortify
Publication date: 2025-09-09
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| trendnet | tew-831dr | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-10107 is a command injection vulnerability in the TRENDnet TEW-831DR router firmware version 1.0. It exists in the handling of the 'sysHost' parameter in the /boafrm/formSysCmd file. Improper input sanitization allows an attacker, after authenticating and obtaining a CSRF token, to inject arbitrary shell commands remotely by manipulating this parameter. This can lead to execution of commands on the device's operating system, enabling actions like starting a telnet daemon or other malicious activities. [1, 2]
How can this vulnerability impact me? :
This vulnerability can lead to severe impacts including remote code execution on the affected device, full system compromise, spawning backdoor shells, exfiltration of sensitive data, and lateral movement within internal networks. It affects the confidentiality, integrity, and availability of the system. Exploitation requires authentication but can be performed remotely with relative ease, and a public proof-of-concept exploit exists. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious POST requests to the endpoint /boafrm/formSysCmd, especially those containing the sysHost parameter with unusual or command-injection-like values (e.g., containing '&&' or shell commands). Detection can involve inspecting HTTP logs or using network monitoring tools to filter POST requests to /boafrm/formSysCmd. A possible command to detect such attempts on a system with access logs is: grep -i 'POST /boafrm/formSysCmd' /path/to/access.log | grep 'sysHost=.*&&.*' to find injected commands. Additionally, monitoring for unexpected telnet daemon startups or unusual processes may indicate exploitation. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include replacing the affected TRENDnet TEW-831DR device or upgrading its firmware if a patch becomes available. Since no vendor patch or official fix exists, it is recommended to restrict network access to the device, especially blocking remote access to the /boafrm/formSysCmd endpoint. Input validation should be implemented to allow only safe hostnames or IP addresses for the sysHost parameter, using regular expressions. Employing sandboxing or chroot environments to contain command execution is advised if the functionality is necessary. Ultimately, replacing the vulnerable device is the most effective mitigation. [1, 2]