| Titolo | TRENDnet TEW-751DR, TEW-752DRU, TEW733GR TEW-751DR v1.03B03, TEW-752DRU v1.03B01, TEW733GR v1.03B01 OS Command Injection |
|---|
| Descrizione | The web management backend (`pigwidgeon.cgi` → `/htdocs/webinc/wand.php`) generates a root-executed shell script (`/var/run/wand_activate_<pid>.sh`) by concatenating an attacker-controlled string with `fwrite()` **without any shell escaping**, then executes it via `sh`. An authenticated administrator can inject arbitrary OS commands through the `<service>` element of the session configuration (postxml), achieving **root command execution**. When chained with CVE-2018-7034 (authentication bypass + cleartext password disclosure in the same firmware), the entire attack chain is **unauthenticated**, yielding remote root compromise of the device over the WAN-facing management port (8080). |
|---|
| Fonte | ⚠️ https://github.com/dacj4n/TRENDNetExploits |
|---|
| Utente | dacjun (UID 101052) |
|---|
| Sottomissione | 07/09/2026 04:20 (2 mesi fa) |
|---|
| Moderazione | 11/10/2026 11:41 (1 month later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 416581 [TRENDnet TEW-751DR/TEW-752DRU/TEW733GR 1.03B01/1.03B03 Web Management Backend pigwidgeon.cgi fwrite service escalationi di privilegi] |
|---|
| Punti | 20 |
|---|