Read the docs
TI-2026-06692 Aliases CVE-2026-7609GHSA-qx7x-73f2-8q44

TRENDnet TEW-821DAP Firmware Udpate diagnostic tools_diagnostic os command injection

Priority MEDIUM 57CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

A flaw has been found in TRENDnet TEW-821DAP up to 1.12B01. The impacted element is the function tools_diagnostic of the file /tmp/diagnostic of the component Firmware Udpate. This manipulation causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor explains: "That firmware version will only work on our hardware version v1.xR. We have already EOL that product 8 years ago and are no longer selling". This vulnerability only affects products that are no longer supported by the maintainer.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0453 91st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TRENDnetTEW-821DAP1.12B01—No fix listedCNA
  • TEW-821DAP VendorTRENDnet Affected 1.12B01 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:trendnet:tew-821dap_firmware:1.12b01:*:*:*:*:*:*:*1.12b01VulnerableTRENDnet
cpe:2.3:h:trendnet:tew-821dap:1.0r:*:*:*:*:*:*:*1.0rRunning onTRENDnet
  • cpe:2.3:o:trendnet:tew-821dap_firmware:1.12b01:*:*:*:*:*:*:* Versions 1.12b01 Vulnerable ·TRENDnet
  • cpe:2.3:h:trendnet:tew-821dap:1.0r:*:*:*:*:*:*:* Versions 1.0r Running on ·TRENDnet

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-7609
  2. 2026-10-03 Alias added: GHSA-qx7x-73f2-8q44

References

Exploit 1

  • TI-2023-27953 An issue in TRENDnet Trendnet AC1200 Dual Band PoE Indoor Wireless Access Point… CVSS 3.1HIGH 8.0
  • TI-2023-27952 Buffer Overflow vulnerability in TRENDnet Trendnet AC1200 TEW-821DAP with firmware… CVSS 3.1HIGH 8.0
  • TI-2023-27951 Buffer Overflow vulnerability in TRENDnet AC1200 TEW-821DAP with firmware version 3.00b06… CVSS 3.1HIGH 8.0
  • TI-2026-06691 TRENDnet TEW-821DAP tools_diagnostic os command injection CVSS 4.0MEDIUM 5.1
  • TI-2026-06690 TRENDnet TEW-821DAP Firmware Udpate auto_update_firmware buffer overflow CVSS 4.0HIGH 8.7
  • TI-2026-06694 TRENDnet TEW-821DAP Firmware Update cameo_dev.sh platform_do_upgrade_cameo_dev data authenticity CVSS 4.0MEDIUM 6.3
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences