| Title | TRENDnet TEW-751DR, TEW-752DRU, TEW733GR TEW-751DR v1.03B03, TEW-752DRU v1.03B01, TEW733GR v1.03B01 OS Command Injection |
|---|
| Description | The web management backend (`pigwidgeon.cgi` → `/htdocs/webinc/wand.php`) generates a root-executed shell script (`/var/run/wand_activate_<pid>.sh`) by concatenating an attacker-controlled string with `fwrite()` **without any shell escaping**, then executes it via `sh`. An authenticated administrator can inject arbitrary OS commands through the `<service>` element of the session configuration (postxml), achieving **root command execution**. When chained with CVE-2018-7034 (authentication bypass + cleartext password disclosure in the same firmware), the entire attack chain is **unauthenticated**, yielding remote root compromise of the device over the WAN-facing management port (8080). |
|---|
| Source | ⚠️ https://github.com/dacj4n/TRENDNetExploits |
|---|
| User | dacjun (UID 101052) |
|---|
| Submission | 09/07/2026 04:20 (2 months ago) |
|---|
| Moderation | 10/11/2026 11:41 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416581 [TRENDnet TEW-751DR/TEW-752DRU/TEW733GR 1.03B01/1.03B03 Web Management Backend pigwidgeon.cgi fwrite service os command injection] |
|---|
| Points | 20 |
|---|