Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.9
CVE-2025-8759: TRENDnet TN-200: Unsecured Cryptographic Key Exposes Data
CVE-2025-8759 · published 1 year ago
Summary
A weakness in the TRENDnet TN-200's web server, Lighttpd, allows an attacker to exploit a hardcoded cryptographic key. This could allow unauthorized access to sensitive data. TRENDnet's developers have been notified but have not responded. It's recommended to check for updates or consider replacing the device.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| trendnet | tn-200_firmware |
1.02b02 cpe:2.3:o:trendnet:tn-200_firmware:1.02b02:*:*:*:*:*:*:* |
Original advisory text
A vulnerability was found in TRENDnet TN-200 1.02b02. It has been declared as problematic. This vulnerability affects unknown code of the component Lighttpd. The manipulation of the argument secdow...
A vulnerability was found in TRENDnet TN-200 1.02b02. It has been declared as problematic. This vulnerability affects unknown code of the component Lighttpd. The manipulation of the argument secdownload.secret with the input neV3rUseMe leads to use of hard-coded cryptographic key
. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
References
- https://vuldb.com/?ctiid.319264 Permissions Required VDB Entry
- https://vuldb.com/?id.319264 Third Party Advisory VDB Entry
- https://vuldb.com/?submit.624555 Third Party Advisory VDB Entry
- https://www.notion.so/23f54a1113e7801e944ec65a2f7c5448 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.9
Low
Type
CWE-320Key Management Errors
CWE-321Use of Hard-coded Cryptographic Key
Timeline
Published9 Aug 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-8759 · NVD
Track software like this
Free during beta