| 제목 | Trendnet TEW-821DAP v1.11B03 CWE-78 Improper Neutralization of Special Elements used in an O |
|---|
| 설명 | During the firmware update process, there is command injection vulnerability in function sub_42026C of program ssi. In the concatenation of DDNS configuration strings, variables hostname, username, and password are directly concatenated into the configuration strings. Then, the configuration strings is written into config file and the DDNS restart command is executed. However, these variables are propagated from the user input without any verification. Once the hackers control the user input, malicious command could be injected into the configuration strings. |
|---|
| 원천 | ⚠️ https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Trendnet/TEW-821DAP_CI4.md |
|---|
| 사용자 | IOT_Res (UID 81722) |
|---|
| 제출 | 2026. 05. 29. AM 08:56 (4 개월 ago) |
|---|
| 모더레이션 | 2026. 07. 11. PM 12:12 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 377793 [TRENDnet TEW-821DAP 1.11B03 Firmware Update /goform/tools_ddns sub_42026C hostname/username/password 권한 상승] |
|---|
| 포인트들 | 20 |
|---|