| tiêu đề | Trendnet TEW-821DAP v1.12B01 CWE-78 Improper Neutralization of Special Elements used in an OS |
|---|
| Mô tả | During the firmware update process, there is command injection vulnerability in function tools_diagnostic() of program ssi. The users first input the IP address in the web page which would performs regular expression validation and transfer the IP address to ssi through AJAX POST request. Then, in the tools_diagnostic() of program ssi, the IP address is stored in variable s and is used as a parameter of the ping command. However, the hackers could inject malicious command into IP address. This issue in the firmware update process of Trendnet TEW-821DAP (firmware version:v1.12B01) allows attackers to execute arbitrary code or cause denial of service via constructing POST request that contains malicious command. |
|---|
| Nguồn | ⚠️ https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Trendnet/TEW-821DAP_CI1.md |
|---|
| Người dùng | IOT_Res (UID 81722) |
|---|
| Đệ trình | 16/04/2026 04:33 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 01/05/2026 14:07 (15 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 360565 [TRENDnet TEW-821DAP đến 1.12B01 tools_diagnostic nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|