| tiêu đề | TRENDnet TEW-713RE 1.02 OS Command Injection |
|---|
| Mô tả | A pre-authentication command injection vulnerability exists in the formFSrvX handler of the Trendnet TEW-713RE firmware. The vulnerable endpoint /goformX/formFSrvX is exposed without any authentication and accepts a user-controlled parameter SZCMD, which is directly executed by the backend as a shell command.Because no authentication or session verification is enforced on the /goformX/formFSrvX endpoint, a remote unauthenticated attacker can send a single crafted HTTP request to execute arbitrary commands with root privileges. Successful exploitation allows full device compromise, including file creation, service manipulation, backdoor installation, and potential lateral movement within the network. |
|---|
| Nguồn | ⚠️ https://pentagonal-time-3a7.notion.site/Command-Injection-Vulnerability-in-formFSrvX-of-Trendnet-TEW-713RE-2d1e5dd4c5a5801481abe7a944763d39 |
|---|
| Người dùng | Anonymous User |
|---|
| Đệ trình | 22/12/2025 11:42 (cách đây 8 các tháng) |
|---|
| Kiểm duyệt | 06/01/2026 17:28 (15 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 339721 [TRENDnet TEW-713RE 1.02 /goformX/formFSrvX SZCMD nâng cao đặc quyền] |
|---|
| điểm | 17 |
|---|