Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-108804: TRENDnet TEW‑751DR/752DRU/733GR remote command execution
CVE-2026-108804 · published today
Summary
The web‑based administration interface on these TRENDnet routers can be tricked into running arbitrary system commands. An attacker on the network could use this to take control of the router or learn sensitive information. Because the models have been out of support since 2011, the safest step is to replace them with supported equipment or block remote access to the management interface.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| trendnet | tew-751dr | 1.03B01 |
| trendnet | tew-752dru | 1.03B01 |
| trendnet | tew733gr | 1.03B01 |
Original advisory text
TRENDnet TEW-751DR/TEW-752DRU/TEW733GR Web Management Backend pigwidgeon.cgi fwrite os command injection
A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the component Web Management Backend. The manipulation of the argument service results in os command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor confirms: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product." This vulnerability only affects products that are no longer supported by the maintainer.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Severity
9.3
Critical
Type
CWE-78OS Command Injection
CWE-77Command Injection
Timeline
Published12 Oct 2026
Updated12 Oct 2026
First seen12 Oct 2026
Track software like this
Free during beta