Is CVE-2026-108804 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108804 being exploited in the wild.

How severe is CVE-2026-108804?

Critical severity, with a CVSS score of 10, published 12 October 2026.

Which products and versions are affected?

TRENDnet TEW-733GR 1.03B01, 1.03B03; TRENDnet TEW-751DR 1.03B01, 1.03B03; TRENDnet TEW-752DRU 1.03B01, 1.03B03.

Is there a fix for CVE-2026-108804?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-108804 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-108804?

Check whether you run TRENDnet TEW-733GR, TRENDnet TEW-751DR or TRENDnet TEW-752DRU at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108804: TRENDnet TEW-751DR/TEW-752DRU/TEW-733GR OS command injection in web management

CVE-2026-108804 · Severity: critical · CVSS 10 · Published 2026-10-12

TRENDnet routers from the early 2010s contain a critical command injection flaw in their web-based management interface. An attacker can remotely execute arbitrary operating system commands on the router by manipulating the service parameter, potentially gaining complete control of the device and the network it protects. The routers have been unsupported since 2011, and no fix will be available.

Vendors: TRENDnet.

Quick answers

Is CVE-2026-108804 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108804 being exploited in the wild.
How severe is CVE-2026-108804?: Critical severity, with a CVSS score of 10, published 12 October 2026.
Which products and versions are affected?: TRENDnet TEW-733GR 1.03B01, 1.03B03; TRENDnet TEW-751DR 1.03B01, 1.03B03; TRENDnet TEW-752DRU 1.03B01, 1.03B03.
Is there a fix for CVE-2026-108804?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-108804 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-108804?: Check whether you run TRENDnet TEW-733GR, TRENDnet TEW-751DR or TRENDnet TEW-752DRU at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an OS command injection in the pigwidgeon.cgi web management backend component, specifically in the fwrite function where the service argument is not properly sanitized. The flaw allows unauthenticated remote code execution over the network, requiring only network access to the router's management interface. An attacker can inject shell commands that execute with router privileges, fully compromising device integrity and confidentiality.

Affected products

TRENDnet TEW-751DR 1.03B01, 1.03B03
TRENDnet TEW-752DRU 1.03B01, 1.03B03
TRENDnet TEW-733GR 1.03B01, 1.03B03

Timeline

2026-10-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.