# CVE-2026-77945: TRENDnet TEW-821DAP command injection in upload.cgi

Source: https://junglewise.ai/threats/cve-2026-77945-trendnet-tew-821dap-command-injection-in-upload-cgi  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77945 · Severity: high · CVSS 7.4 · Published 2026-08-22

The TRENDnet TEW-821DAP is a wireless access point used to provide network connectivity in small office and home environments. A remote attacker can execute arbitrary system commands through a malicious filename parameter in the web-based file upload interface, potentially compromising the device and any networks it serves.

Technologies: [TRENDnet TEW-821DAP](https://junglewise.ai/threats/technologies/tew-821dap). Vendors: [TRENDnet](https://junglewise.ai/threats/vendors/trendnet).

## Quick answers

**Is CVE-2026-77945 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77945 being exploited in the wild.

**How severe is CVE-2026-77945?** High severity, with a CVSS score of 7.4, published 22 August 2026.

**Which products and versions are affected?** TRENDnet TEW-821DAP 2.2.01b05.

**Is there a fix for CVE-2026-77945?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-77945 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-77945?** Check whether you run TRENDnet TEW-821DAP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in the /cgi-bin/upload.cgi file of the TRENDnet TEW-821DAP firmware version 2.2.01b05. The vulnerability is located in the handling of the "filename" argument in the ssi (Server-Side Include) component. The application fails to properly sanitize user input before passing it to a system command, allowing an unauthenticated remote attacker to inject shell metacharacters and execute arbitrary commands with device privileges. The attack requires only network access to the device's web interface and no authentication. An attacker exploiting this vulnerability could gain complete control of the device.

## Affected products

- TRENDnet TEW-821DAP 2.2.01b05

## Timeline

- 2026-08-22: disclosed
- exploited: Exploit code made public on GitHub

## References

- [https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TEW-821DAP_ssi_Arbitrary_File_Command_Injection.md](https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TEW-821DAP_ssi_Arbitrary_File_Command_Injection.md)
- [https://vuldb.com/cve/CVE-2026-77945](https://vuldb.com/cve/CVE-2026-77945)

## Related threats

- [TRENDnet TEW-821DAP stack-based buffer overflow in NTP timezone configuration](https://junglewise.ai/threats/cve-2026-77946-trendnet-tew-821dap-stack-based-buffer-overflow-in-ntp-timezone)
- [TRENDnet TEW-821DAP OS command injection in system_ntp](https://junglewise.ai/threats/cve-2026-15487-trendnet-tew-821dap-os-command-injection-in-system-ntp)
- [TRENDnet TEW-821DAP OS command injection in tools_ddns](https://junglewise.ai/threats/cve-2026-15486-trendnet-tew-821dap-os-command-injection-in-tools-ddns)
- [TRENDnet TEW-821DAP command injection in DNS Lookup Handler](https://junglewise.ai/threats/cve-2026-15485-trendnet-tew-821dap-command-injection-in-dns-lookup-handler)
- [TRENDnet TEW-821DAP buffer overflow in tools_nslookup](https://junglewise.ai/threats/cve-2026-15484-trendnet-tew-821dap-buffer-overflow-in-tools-nslookup)