An issue was discovered on TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU…
Priority MEDIUM 48CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.
Summary
An issue was discovered on TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices. OS command injection occurs through the get_set.ccp lanHostCfg_HostName_1.1.1.0.0 parameter.
Why it matters now
EPSS 0.0304 87th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:trendnet:tew-651br_firmware:2.04b1:*:*:*:*:*:*:* | 2.04b1 | Vulnerable | TRENDnet |
| cpe:2.3:h:trendnet:tew-651br:-:*:*:*:*:*:*:* | not specified by NVD | Running on | TRENDnet |
| cpe:2.3:o:trendnet:tew-652brp_firmware:3.04b01:*:*:*:*:*:*:* | 3.04b01 | Vulnerable | TRENDnet |
| cpe:2.3:h:trendnet:tew-652brp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | TRENDnet |
| cpe:2.3:o:trendnet:tew-652bru_firmware:1.00b12:*:*:*:*:*:*:* | 1.00b12 | Vulnerable | TRENDnet |
| cpe:2.3:h:trendnet:tew-652bru:-:*:*:*:*:*:*:* | not specified by NVD | Running on | TRENDnet |
- cpe:2.3:o:trendnet:tew-651br_firmware:2.04b1:*:*:*:*:*:*:* Versions 2.04b1 Vulnerable ·TRENDnet
- cpe:2.3:h:trendnet:tew-651br:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TRENDnet
- cpe:2.3:o:trendnet:tew-652brp_firmware:3.04b01:*:*:*:*:*:*:* Versions 3.04b01 Vulnerable ·TRENDnet
- cpe:2.3:h:trendnet:tew-652brp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TRENDnet
- cpe:2.3:o:trendnet:tew-652bru_firmware:1.00b12:*:*:*:*:*:*:* Versions 1.00b12 Vulnerable ·TRENDnet
- cpe:2.3:h:trendnet:tew-652bru:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TRENDnet
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-11399
- 2026-10-03 Alias added: GHSA-cgqw-rfm9-79j7
References
More TRENDnet Tew-651br Firmware vulnerabilities
- TI-2015-01070 The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute… KEVCVSS 3.1CRITICAL 9.8
- TI-2019-08516 An issue was discovered on TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU… CVSS 3.1CRITICAL 9.8
- TI-2024-34278 TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a… CVSS 3.1MEDIUM 4.8
- TI-2024-34277 TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a… CVSS 3.1MEDIUM 4.8
- TI-2024-34276 TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a… CVSS 3.1MEDIUM 4.8
- TI-2024-34275 TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a… CVSS 3.1MEDIUM 4.8
Sources
- CVE-2019-11399 · CVE Program
- CVE-2019-11399 · NVD
- FIRST EPSS
- GHSA-cgqw-rfm9-79j7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences