Is CVE-2026-15487 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15487 being exploited in the wild.

How severe is CVE-2026-15487?

Medium severity, with a CVSS score of 6.3, published 12 July 2026.

Is there a fix for CVE-2026-15487?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15487 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-15487?

Check whether you run TRENDnet TEW-821DAP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15487: TRENDnet TEW-821DAP OS command injection in system_ntp

CVE-2026-15487 · Severity: medium · CVSS 6.3 · Published 2026-07-12

A security vulnerability exists in the TRENDnet TEW-821DAP wireless access point, a device used to provide Wi-Fi connectivity in business environments. An attacker can exploit the device's time synchronization settings to execute unauthorized commands on the underlying operating system. This could allow a remote attacker to gain control over the device, potentially leading to network disruptions or unauthorized access to network traffic. Note that the manufacturer has designated this product as End-of-Life (EOL) and does not intend to release a fix.

Technologies: TRENDnet TEW-821DAP. Vendors: TRENDnet.

Quick answers

Is CVE-2026-15487 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15487 being exploited in the wild.
How severe is CVE-2026-15487?: Medium severity, with a CVSS score of 6.3, published 12 July 2026.
Which products and versions are affected?: TRENDnet TEW-821DAP 1.11B03.
Is there a fix for CVE-2026-15487?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15487 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-15487?: Check whether you run TRENDnet TEW-821DAP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability exists in the TRENDnet TEW-821DAP firmware version 1.11B03 within the 'ssi' program. The vulnerability is located in function sub_41FBD0 (NTP handler) at the /goform/system_ntp endpoint. The 'Hostname' parameter provided via an HTTP POST request is concatenated into a shell command string using sprintf() and subsequently executed via system() without proper sanitization. An authenticated attacker can exploit this to execute arbitrary shell commands with the privileges of the web server. The vendor has stated the product is End-of-Life (EOL) and will not be patched.

Affected products

TRENDnet TEW-821DAP 1.11B03

Timeline

2026-07-12: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.