# CVE-2026-77988: TRENDnet TEW-823DRU command injection in CLI configuration

Source: https://junglewise.ai/threats/cve-2026-77988-trendnet-tew-823dru-command-injection-in-cli-configuration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77988 · Severity: medium · CVSS 6.6 · Published 2026-08-22

The TRENDnet TEW-823DRU is a network router used to provide wireless connectivity in homes and offices. A command injection vulnerability in its configuration interface allows an attacker to execute arbitrary system commands remotely, potentially taking full control of the device and using it as a foothold to attack connected networks or intercept user traffic.

Vendors: [TRENDnet](https://junglewise.ai/threats/vendors/trendnet).

## Quick answers

**Is CVE-2026-77988 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77988 being exploited in the wild.

**How severe is CVE-2026-77988?** Medium severity, with a CVSS score of 6.6, published 22 August 2026.

**Which products and versions are affected?** TRENDnet TEW-823DRU 1.1.02b01.

**Is there a fix for CVE-2026-77988?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-77988 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-77988?** Check whether you run TRENDnet TEW-823DRU at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in the nvram_get function of the CLI Configuration Tool component in TRENDnet TEW-823DRU firmware version 1.1.02b01. The vulnerability stems from insufficient input validation that allows an attacker to inject shell commands through the configuration interface. The attack is remotely exploitable and does not require prior authentication. An attacker can leverage this vulnerability to execute arbitrary commands with the privileges of the router's web server or administrative user, potentially gaining complete control over the device. Public exploits are available.

## Affected products

- TRENDnet TEW-823DRU 1.1.02b01

## Timeline

- 2026-08-22: disclosed

## References

- [https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TEW-823DRU_bin_cli_NVRAM_Command_Injection.md](https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TEW-823DRU_bin_cli_NVRAM_Command_Injection.md)
- [https://vuldb.com/cve/CVE-2026-77988](https://vuldb.com/cve/CVE-2026-77988)