Is CVE-2026-15485 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15485 being exploited in the wild.

How severe is CVE-2026-15485?

Medium severity, with a CVSS score of 6.3, published 12 July 2026.

Is there a fix for CVE-2026-15485?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15485 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-15485?

Check whether you run TRENDnet TEW-821DAP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15485: TRENDnet TEW-821DAP command injection in DNS Lookup Handler

CVE-2026-15485 · Severity: medium · CVSS 6.3 · Published 2026-07-12

A security vulnerability has been identified in the TRENDnet TEW-821DAP wireless access point, a device used to provide Wi-Fi connectivity in business environments. An attacker could exploit this flaw to take control of the device by injecting malicious commands through the network diagnostic tools. Because this product has reached its end-of-life status, the manufacturer will not be providing a security patch, leaving affected devices permanently vulnerable.

Technologies: TRENDnet TEW-821DAP. Vendors: TRENDnet.

Quick answers

Is CVE-2026-15485 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15485 being exploited in the wild.
How severe is CVE-2026-15485?: Medium severity, with a CVSS score of 6.3, published 12 July 2026.
Which products and versions are affected?: TRENDnet TEW-821DAP 1.11B03.
Is there a fix for CVE-2026-15485?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15485 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-15485?: Check whether you run TRENDnet TEW-821DAP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability exists in the TRENDnet TEW-821DAP firmware version 1.11B03 within the 'ssi' binary. The flaw is located in function sub_43F2C4, which handles DNS lookup requests via the /goform/tools_nslookup endpoint. The application fails to sanitize the 'nslookup_target' and 'dns_server' POST parameters before passing them to a sprintf call that constructs a system command (e.g., "nslookup %s %s"). An authenticated attacker can inject shell metacharacters into these parameters to execute arbitrary code with the privileges of the web server. The vendor has stated the product is End-of-Life (EOL) and will not be patched.

Affected products

TRENDnet TEW-821DAP 1.11B03

Timeline

2026-07-12: advisory: NVD publication date
2026-07-12: disclosed: Initial disclosure via VulDB and GitHub research report

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.