CVE-2026-77945
Received Received - Intake

Command Injection in TRENDnet TEW-821DAP Router

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: VulDB

Description
A vulnerability was found in TRENDnet TEW-821DAP 2.2.01b05. Affected is an unknown function of the file /cgi-bin/upload.cgi of the component ssi. Performing a manipulation of the argument filename results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-77945
EUVD
EUVD-2026-64245

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
trendnet tew-821dap 2.2.01b05

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77945 is a command injection vulnerability in TRENDnet TEW-821DAP firmware v2.2.01b05. The flaw exists in the cgi/ssi binary where the filename parameter from a file upload request is passed unsanitized to the _system() function. Attackers can inject arbitrary system commands via a crafted filename, enabling remote code execution with root privileges. Exploitation requires sending a malicious HTTP POST request to /cgi-bin/upload.cgi.

Detection Guidance

To detect this vulnerability, check if your TRENDnet TEW-821DAP device is running firmware version v2.2.01b05. Scan for open ports 80 or 443 on the device's IP address. Send a crafted HTTP POST request to /cgi-bin/upload.cgi with a malicious filename parameter containing command injection payloads like semicolons to test for command execution.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on the device with root privileges. Potential impacts include complete device compromise, network traffic interception, pivoting to other devices, installing persistent backdoors, or causing denial of service. The attack can be launched remotely without authentication if the device's management interface is exposed.

Compliance Impact

This vulnerability could lead to unauthorized access and control of network devices, potentially exposing sensitive data. For GDPR, it may result in data breaches requiring notification under Articles 33-34. For HIPAA, it risks compromising protected health information if the device is used in healthcare environments.

Mitigation Strategies

Immediately update the device firmware to the latest version. Disable remote access to the web management interface if not required. Restrict network access to the device using firewall rules. Replace unsafe _system() calls in the firmware with safer alternatives like execve(). Implement strict filename validation using a whitelist approach.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77945. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart