| शीर्षक | TRENDnet TEW-713RE 1.02 OS Command Injection |
|---|
| विवरण | A pre-authentication command injection vulnerability exists in the formFSrvX handler of the Trendnet TEW-713RE firmware. The vulnerable endpoint /goformX/formFSrvX is exposed without any authentication and accepts a user-controlled parameter SZCMD, which is directly executed by the backend as a shell command.Because no authentication or session verification is enforced on the /goformX/formFSrvX endpoint, a remote unauthenticated attacker can send a single crafted HTTP request to execute arbitrary commands with root privileges. Successful exploitation allows full device compromise, including file creation, service manipulation, backdoor installation, and potential lateral movement within the network. |
|---|
| स्रोत | ⚠️ https://pentagonal-time-3a7.notion.site/Command-Injection-Vulnerability-in-formFSrvX-of-Trendnet-TEW-713RE-2d1e5dd4c5a5801481abe7a944763d39 |
|---|
| उपयोगकर्ता | Anonymous User |
|---|
| सबमिशन | 22/12/2025 11:42 AM (8 महीनों पहले) |
|---|
| संयम | 06/01/2026 05:28 PM (15 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 339721 [TRENDnet TEW-713RE 1.02 /goformX/formFSrvX SZCMD अधिकार वृद्धि] |
|---|
| अंक | 17 |
|---|