# CVE-2026-76591: TRENDnet TEW-755AP command injection in SSI email function

Source: https://junglewise.ai/threats/cve-2026-76591-trendnet-tew-755ap-command-injection-in-ssi-email-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76591 · Severity: high · CVSS 7.4 · Published 2026-08-19

The TRENDnet TEW-755AP wireless access point contains a command injection vulnerability in its web-based configuration interface. An attacker can send a specially crafted request to the email configuration page to execute arbitrary system commands on the device with no authentication required. This could allow an attacker to gain full control of the access point, intercept network traffic, or use it as a foothold to attack other devices on the network.

Technologies: [TRENDnet TEW-755AP](https://junglewise.ai/threats/technologies/tew-755ap). Vendors: [TRENDnet](https://junglewise.ai/threats/vendors/trendnet).

## Quick answers

**Is CVE-2026-76591 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76591 being exploited in the wild.

**How severe is CVE-2026-76591?** High severity, with a CVSS score of 7.4, published 19 August 2026.

**Which products and versions are affected?** TRENDnet TEW-755AP up to version 20260702.

**Is there a fix for CVE-2026-76591?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-76591 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-76591?** Check whether you run TRENDnet TEW-755AP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a command injection flaw (CWE-77) in the log_email_server parameter of the /cgi-bin/email.cgi endpoint, which is processed by the SSI (Server-Side Includes) component without proper sanitization. The vulnerable function log_email_server accepts user input and passes it to a shell command without filtering shell metacharacters such as semicolons and pipes. The attack is network-accessible and requires no authentication. An attacker can inject shell commands that execute with the privileges of the web server process, potentially allowing remote code execution. The exploit proof-of-concept has been publicly released.

## Affected products

- TRENDnet TEW-755AP up to version 20260702

## Timeline

- 2026-08-19: disclosed
- exploited: Exploit proof-of-concept publicly released

## References

- [https://github.com/meishigana/CVE/blob/main/team15_20260702/14_755ap-ssi-cmdi/poc/poc-ssi-injection.py](https://github.com/meishigana/CVE/blob/main/team15_20260702/14_755ap-ssi-cmdi/poc/poc-ssi-injection.py)
- [https://github.com/meishigana/CVE/tree/main/team15_20260702/14_755ap-ssi-cmdi](https://github.com/meishigana/CVE/tree/main/team15_20260702/14_755ap-ssi-cmdi)

## Related threats

- [TRENDnet TEW-755AP stack buffer overflow in WAN configuration](https://junglewise.ai/threats/cve-2026-76590-trendnet-tew-755ap-stack-buffer-overflow-in-wan-configuration)
- [TRENDnet TEW-755AP stack buffer overflow in mycli](https://junglewise.ai/threats/cve-2026-76589-trendnet-tew-755ap-stack-buffer-overflow-in-mycli)