Executive brief
The TRENDnet TEW-821DAP is a wireless access point used to provide network connectivity in small office and home environments. A remote attacker can execute arbitrary system commands through a malicious filename parameter in the web-based file upload interface, potentially compromising the device and any networks it serves.
Technical details
A command injection vulnerability exists in the /cgi-bin/upload.cgi file of the TRENDnet TEW-821DAP firmware version 2.2.01b05. The vulnerability is located in the handling of the "filename" argument in the ssi (Server-Side Include) component. The application fails to properly sanitize user input before passing it to a system command, allowing an unauthenticated remote attacker to inject shell metacharacters and execute arbitrary commands with device privileges. The attack requires only network access to the device's web interface and no authentication. An attacker exploiting this vulnerability could gain complete control of the device.
Affected products
- TRENDnet TEW-821DAP 2.2.01b05
Timeline
- 2026-08-22: disclosed
- exploited: Exploit code made public on GitHub