CVE-2019-13278

published 2019-07-10

CVE-2019-13278: TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains multiple command injections when processing user input for the setup wizard, allowing an…

Priority P2 66 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains multiple command injections when processing user input for the setup wizard, allowing an unauthenticated user to run arbitrary commands on the device. The vulnerability can be exercised on the local intranet or remotely if remote administration is enabled.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
trendnet	tew-827dru_firmware	<= 2.04b03	—

Detection & IOCs extracted from sources · hover to see the quote

• → CVE-2019-13278 affects TRENDnet TEW-827DRU firmware up to and including 2.04B03; the vulnerability is multiple command injections triggered via user input to the setup wizard, exploitable by an unauthenticated user on the local intranet or remotely if remote administration is enabled. ↗

• · Remote exploitation of CVE-2019-13278 requires remote administration to be enabled on the device; local intranet exploitation requires no such precondition and no authentication. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78