TI-2026-06693 Aliases CVE-2026-7610 GHSA-2h5m-pw5f-fv48

TRENDnet TEW-821DAP Firmware Update ssi cleartext transmission

LOW 28CWE-310Published 2026-05-02 · Updated 2026-05-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-319.

Summary

A vulnerability has been found in TRENDnet TEW-821DAP 1.12B01. This affects an unknown function of the file /www/cgi/ssi of the component Firmware Update. Such manipulation leads to cleartext transmission of sensitive information. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is reported as difficult. The exploit has been disclosed to the public and may be used. The vendor explains: "That firmware version will only work on our hardware version v1.xR. We have already EOL that product 8 years ago and are no longer selling". This vulnerability only affects products that are no longer supported by the maintainer.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00319 24th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TRENDnet	TEW-821DAP	1.12B01	—	No fix listed	CNA

TEW-821DAP VendorTRENDnet Affected 1.12B01 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:trendnet:tew-821dap_firmware:1.12b01:::::::*	1.12b01	Vulnerable	TRENDnet
cpe:2.3:h:trendnet:tew-821dap:1.0r:::::::*	1.0r	Running on	TRENDnet

cpe:2.3:o:trendnet:tew-821dap_firmware:1.12b01:*:*:*:*:*:*:* Versions 1.12b01 Vulnerable ·TRENDnet
cpe:2.3:h:trendnet:tew-821dap:1.0r:*:*:*:*:*:*:* Versions 1.0r Running on ·TRENDnet

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-7610
2026-10-03 Alias added: GHSA-2h5m-pw5f-fv48

References

Exploit 1

https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Trendnet/TEW-821DAP_Down.md

TI-2023-27953 An issue in TRENDnet Trendnet AC1200 Dual Band PoE Indoor Wireless Access Point… CVSS 3.1HIGH 8.0
TI-2023-27952 Buffer Overflow vulnerability in TRENDnet Trendnet AC1200 TEW-821DAP with firmware… CVSS 3.1HIGH 8.0
TI-2023-27951 Buffer Overflow vulnerability in TRENDnet AC1200 TEW-821DAP with firmware version 3.00b06… CVSS 3.1HIGH 8.0
TI-2026-06692 TRENDnet TEW-821DAP Firmware Udpate diagnostic tools_diagnostic os command injection CVSS 4.0MEDIUM 5.3
TI-2026-06691 TRENDnet TEW-821DAP tools_diagnostic os command injection CVSS 4.0MEDIUM 5.1
TI-2026-06690 TRENDnet TEW-821DAP Firmware Udpate auto_update_firmware buffer overflow CVSS 4.0HIGH 8.7

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences