CVE-2026-76591

Received Received - Intake

Command Injection in TRENDnet TEW-755AP

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulDB

Description

A security flaw has been discovered in TRENDnet TEW-755AP up to 20260702. This affects the function log_email_server of the file /cgi-bin/email.cgi of the component ssi. Performing a manipulation results in command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76591

EUVD

EUVD-2026-63136

Affected Vendors & Products

Vendor	Product	Version / Range
trendnet	tew-755ap	to 20260702 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is a command injection flaw in TRENDnet TEW-755AP devices up to firmware version 20260702. It exists in the log_email_server function of the /cgi-bin/email.cgi file, specifically in the ssi component. Attackers can remotely exploit this to execute arbitrary commands on the device.

Impact Analysis

An attacker could gain unauthorized access to your TRENDnet device, potentially stealing sensitive information, modifying device settings, or using it as a foothold to attack other systems on your network. The public availability of the exploit increases the risk of real-world attacks.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations may face compliance penalties if this flaw is exploited due to inadequate security measures.

Mitigation Strategies

Immediately update the TRENDnet TEW-755AP firmware to the latest version to patch the command injection flaw in the email.cgi component. If no patch is available, consider disabling remote access to the device or isolating it from critical network segments until a fix is applied.

Hi! I’m here to help you understand CVE-2026-76591. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70