CVE-2024-57590

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-01-27 · updated 2026-06-17
Weakness: CWE-77

Description

TRENDnet TEW-632BRP v1.010B31 devices have an OS command injection vulnerability in the CGl interface "ntp_sync.cgi",which allows remote attackers to execute arbitrary commands via parameter "ntp_server" passed to the "ntp_sync.cgi" binary through a POST request.

Affected products

TRENDnet Tew-632Brp Firmware: 1.010b31

References

https://github.com/IdaJea/IOT_vuln_1/blob/master/tew632/ntp_sync.md

Get alerted when CVE-2024-57590 or the next vulnerability affects your stack