Read the docs
TI-2026-06689 Aliases CVE-2026-7606GHSA-qh66-v678-hhq5

TRENDnet TEW-821DAP Firmware Update new_gui_update_firmware data authenticity

Priority LOW 28CWE-345Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-345.

Summary

A weakness has been identified in TRENDnet TEW-821DAP 1.12B01. This issue affects the function find_hwid/new_gui_update_firmware of the component Firmware Update Handler. Executing a manipulation of the argument dest can lead to insufficient verification of data authenticity. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The vendor explains: "That firmware version will only work on our hardware version v1.xR. We have already EOL that product 8 years ago and are no longer selling". This vulnerability only affects products that are no longer supported by the maintainer.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00234 14th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TRENDnetTEW-821DAP1.12B01—No fix listedCNA
  • TEW-821DAP VendorTRENDnet Affected 1.12B01 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:trendnet:tew-821dap_firmware:1.12b01:*:*:*:*:*:*:*1.12b01VulnerableTRENDnet
cpe:2.3:h:trendnet:tew-821dap:1.0r:*:*:*:*:*:*:*1.0rRunning onTRENDnet
  • cpe:2.3:o:trendnet:tew-821dap_firmware:1.12b01:*:*:*:*:*:*:* Versions 1.12b01 Vulnerable ·TRENDnet
  • cpe:2.3:h:trendnet:tew-821dap:1.0r:*:*:*:*:*:*:* Versions 1.0r Running on ·TRENDnet

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-7606
  2. 2026-10-03 Alias added: GHSA-qh66-v678-hhq5

References

Exploit 1

  • TI-2023-27953 An issue in TRENDnet Trendnet AC1200 Dual Band PoE Indoor Wireless Access Point… CVSS 3.1HIGH 8.0
  • TI-2023-27952 Buffer Overflow vulnerability in TRENDnet Trendnet AC1200 TEW-821DAP with firmware… CVSS 3.1HIGH 8.0
  • TI-2023-27951 Buffer Overflow vulnerability in TRENDnet AC1200 TEW-821DAP with firmware version 3.00b06… CVSS 3.1HIGH 8.0
  • TI-2026-06692 TRENDnet TEW-821DAP Firmware Udpate diagnostic tools_diagnostic os command injection CVSS 4.0MEDIUM 5.3
  • TI-2026-06691 TRENDnet TEW-821DAP tools_diagnostic os command injection CVSS 4.0MEDIUM 5.1
  • TI-2026-06690 TRENDnet TEW-821DAP Firmware Udpate auto_update_firmware buffer overflow CVSS 4.0HIGH 8.7
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences