What’s Vulnerable › Vulnerabilities

CVE-2026-108804: TRENDnet TEW-751DR/TEW-752DRU/TEW733GR Web Management Backend pigwidgeon.cgi fwrite os command injection

• Severity: critical (CVSS 10.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-12 · updated 2026-10-15
• Weakness: CWE-77

Description

A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the component Web Management Backend. The manipulation of the argument service results in os command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor confirms: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product." This vulnerability only affects products that are no longer supported by the maintainer.

Affected products

• TRENDnet TEW-751DR: 1.03B01, 1.03B03
• TRENDnet TEW-752DRU: 1.03B01, 1.03B03
• TRENDnet TEW733GR: 1.03B01, 1.03B03

References

• https://github.com/dacj4n/TRENDNetExploits
• https://github.com/dacj4n/TRENDNetExploits/tree/main/exploit
• https://vuldb.com/cve/CVE-2026-108804
• https://vuldb.com/submit/962770
• https://vuldb.com/vuln/416581
• https://vuldb.com/vuln/416581/cti

Get alerted when CVE-2026-108804 or the next vulnerability affects your stack