TRENDnet warns of critical command injection in three legacy routers

TRENDnet has acknowledged a critical security vulnerability in three of its older wireless router models, confirming that the flaw allows for remote operating system command injection. The vendor stated it cannot verify the presence of the defect because the affected devices were declared end-of-life in 2011, meaning no software updates or patches will be provided.

The issue is tracked as CVE-2026-108804 and carries a CVSS score of 10, which is classified as critical. According to the National Vulnerability Database, the weakness stems from improper input validation in the `pigwidgeon.cgi` file within the web management backend. Specifically, the `fwrite` function fails to sanitize the `service` argument, enabling attackers to inject and execute arbitrary OS commands remotely.

Context and Background

The vulnerability affects specific firmware versions of three TRENDnet products: the TEW-751DR, TEW-752DRU, and TEW-733GR. Only devices running firmware version 1.03B01 or 1.03B03 are impacted by this flaw. The National Vulnerability Database lists the underlying weaknesses as CWE-78 and CWE-77, which relate to operating system command injection.

TRENDnet confirmed that the exploit code for this vulnerability is now public and may be used by attackers. The vendor noted that it has no way of testing if the vulnerability actually exists in the codebase because the hardware was discontinued more than a decade ago. Despite this inability to verify the technical specifics, the company agreed to notify customers of the potential risk.

Who Is Affected

This vulnerability only affects products that are no longer supported by the maintainer, TRENDnet. The affected models are the TEW-751DR, TEW-752DRU, and TEW-733GR. Users of these routers who have not upgraded their hardware are exposed to remote exploitation. Because the devices are end-of-life, there is no official mitigation path other than replacing the hardware or isolating the devices from the internet.

What should you do?

Organizations and individuals using these specific TRENDnet models should immediately assume their web management interfaces are compromised if accessible from untrusted networks. Since no patch exists, administrators must physically disconnect these devices from the internet or place them behind a strict firewall that blocks all inbound traffic to the web management port.