CVE-2025-15472
OS Command Injection in TRENDnet TEW-811DRU httpd Component
Publication date: 2026-01-07
Last updated on: 2026-01-07
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| trendnet | tew-811dru | 1.0.2.0 |
| trendnet | tew-811dru | 1.0.4.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-15472 is an authenticated OS command injection vulnerability in the TRENDnet TEW-811DRU router firmware (version 1.0.2.0). It exists in the setDeviceURL function of the uapply.cgi file, where the DeviceURL parameter is not properly sanitized before being used in a system command. Although some dangerous characters are blocked, others like pipes (|) and command substitution ($()) are not filtered, allowing an attacker who has authenticated access and a CSRF token to inject arbitrary OS commands. Successful exploitation grants root privileges on the device. [1, 2]
How can this vulnerability impact me? :
This vulnerability can severely impact you by allowing an authenticated attacker to execute arbitrary OS commands with root privileges on the affected TRENDnet TEW-811DRU router. This compromises the confidentiality, integrity, and availability of the device, potentially leading to full device takeover, disruption of network services, data theft, or further attacks within the network. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves verifying if the TRENDnet TEW-811DRU router is running vulnerable firmware (version 1.0.2.0 or 1.0.4.0) and checking for signs of exploitation attempts. Since exploitation requires authentication and a crafted POST request to /uapply.cgi with a malicious DeviceURL parameter, monitoring HTTP POST requests to /uapply.cgi for unusual or suspicious DeviceURL values can help detect attempts. Commands to check the router firmware version or logs depend on the device interface, but generally, you can use network monitoring tools to capture HTTP traffic targeting /uapply.cgi. For example, using tcpdump or Wireshark to filter HTTP POST requests to /uapply.cgi and inspecting the DeviceURL parameter. Specific commands might include: tcpdump -i <interface> -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' and then filter for POST requests to /uapply.cgi. Additionally, checking the router's firmware version via its web interface or SSH (if available) can confirm vulnerability presence. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the affected TRENDnet TEW-811DRU router's management interface to trusted users only, enforcing strong authentication, and monitoring for suspicious activity. Since exploitation requires authentication and a CSRF token, limiting administrative access reduces risk. No official patches or mitigations have been published by the vendor. Therefore, the recommended action is to replace the affected device with a non-vulnerable alternative. Additionally, disabling remote management if enabled and applying network-level controls such as firewall rules to block unauthorized access to the router's management interface can help mitigate exploitation risk. [2]