CVE-2026-5184
Remote Command Injection in TRENDnet TEW-713RE /goform/setSysAdm
Publication date: 2026-03-31
Last updated on: 2026-04-30
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| trendnet | tew-713re_firmware | 1.02 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-5184 is a command injection vulnerability in the Trendnet TEW-713RE router, version 1.02. It occurs in the HTTP endpoint `/goform/setSysAdm`, specifically due to improper handling of the `admuser` parameter. The router's function responsible for processing this parameter does not validate or sanitize the input before passing it to a system command execution function. This allows an attacker to remotely send crafted POST requests that inject and execute arbitrary system commands on the device.
For example, an attacker can send a POST request with the payload `admuser=;ls > /2.txt&admpass=aaaa` which causes the router to execute the `ls` command and write the directory listing to a file named `2.txt`. This demonstrates the ability to run arbitrary commands remotely without proper authorization checks.
How can this vulnerability impact me? :
This vulnerability allows remote attackers to execute arbitrary system commands on the affected router without proper authorization. This can lead to unauthorized access, control over the device, and potential compromise of the network it is connected to.
- Attackers can manipulate the router to perform malicious actions such as data theft, network reconnaissance, or launching further attacks.
- The device could be used as a foothold for attackers to infiltrate other devices on the network.
- Sensitive information stored or transmitted through the router could be exposed or altered.
- The availability and integrity of network services could be disrupted.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending crafted POST requests to the vulnerable router's HTTP endpoint `/goform/setSysAdm` and observing if arbitrary commands can be executed.
A proof-of-concept detection command involves sending a POST request with the `admuser` parameter containing a command injection payload.
For example, using curl to test the vulnerability:
- curl -X POST http://<target-ip>/goform/setSysAdm -H "Authorization: Basic YWRtaW46YWRtaW4=" -H "Content-Type: application/x-www-form-urlencoded" -d "admuser=;ls > /2.txt&admpass=aaaa"
If the command injection is successful, the device will execute the `ls` command and write the output to a file named `2.txt` on the device, confirming the vulnerability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the CVE-2026-5184 vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-5184 vulnerability in the Trendnet TEW-713RE router (version 1.02), immediate steps include restricting remote access to the device, especially to the /goform/setSysAdm endpoint, to prevent exploitation of the command injection via the admuser parameter.
Additionally, changing default credentials and disabling any unnecessary remote management features can reduce the attack surface.
Since the vendor has not responded and no patch is available, monitoring network traffic for suspicious POST requests to /goform/setSysAdm and applying network-level protections such as firewall rules to block unauthorized access is recommended.