CVE-2026-108804
Received Received - Intake

OS Command Injection in TRENDnet TEW-751DR Router

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the component Web Management Backend. The manipulation of the argument service results in os command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor confirms: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product." This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108804
EUVD
EUVD-2026-97238

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
TRENDnet TEW-751DR 1.03B01
TRENDnet TEW-751DR 1.03B03
TRENDnet TEW-752DRU 1.03B01
TRENDnet TEW-752DRU 1.03B03
TRENDnet TEW733GR 1.03B01
TRENDnet TEW733GR 1.03B03

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an OS command injection flaw in TRENDnet TEW-751DR, TEW-752DRU, and TEW733GR routers. It exists in the pigwidgeon.cgi file's fwrite function within the Web Management Backend. Attackers can remotely execute arbitrary commands by manipulating the service argument. The vendor has confirmed the affected products are end-of-life since 2011 and no longer supported.

Detection Guidance

This vulnerability affects outdated TRENDnet devices (TEW-751DR, TEW-752DRU, TEW733GR) with firmware 1.03B01/1.03B03. Check if these devices are present on your network by scanning for their IP addresses or MAC addresses. Use commands like 'nmap -p 80,443 <target_IP>' to identify open web interfaces. Test for the vulnerability by sending a crafted request to pigwidgeon.cgi with a command injection payload.

Impact Analysis

If you use any of the affected TRENDnet router models (TEW-751DR, TEW-752DRU, TEW733GR), an attacker could remotely take control of your device. This may lead to network compromise, data theft, or the device being used in further attacks. Since the devices are unsupported, no security patches will be available.

Compliance Impact

This vulnerability allows remote command injection via the pigwidgeon.cgi component in unsupported TRENDnet devices. For compliance with GDPR or HIPAA, such vulnerabilities in network devices handling sensitive data could lead to unauthorized access, data breaches, or loss of integrity. However, since the affected products are end-of-life (EOL) since 2011, no patches or updates are available, increasing non-compliance risks for organizations still using these devices.

Mitigation Strategies

Since these devices are end-of-life (EOL) and unsupported, the vendor recommends notifying affected users. Immediately isolate these devices from your network to prevent remote exploitation. Replace them with supported, updated alternatives. Monitor network traffic for suspicious activity targeting these devices.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108804. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart