Trendnet
Trendnet Tew-827dru Firmware: vulnerabilidades y CVE
Trendnet Tew-827dru Firmware tiene 42 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 9 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE42
Últimos 12 meses0
Críticas9
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2024-36729 | Media (6.3) | 5.3% | — | 3 jun 2024 | TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action wizard_ipv6… |
| CVE-2024-36728 | Alta (8.1) | 5.2% | — | 3 jun 2024 | TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action… |
| CVE-2024-28354 | Crítica (10) | 2.2% | — | 15 mar 2024 | There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. An attacker can inject commands into the post request parameters usapps.@smb[%d].username in the apply.cgi… |
| CVE-2024-28353 | Alta (8.8) | 2.1% | — | 15 mar 2024 | There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. An attacker can inject commands into the post request parameters usapps.config.smb_admin_name in the apply.cgi… |
| CVE-2021-20165 | Alta (8.8) | 0.63% | — | 30 dic 2021 | Trendnet AC2600 TEW-827DRU version 2.08B01 does not properly implement csrf protections. Most pages lack proper usage of CSRF protections or mitigations. Additionally, pages that do make use of CSRF tokens are trivially… |
| CVE-2021-20164 | Media (4.9) | 0.73% | — | 30 dic 2021 | Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses credentials for the smb functionality of the device. Usernames and passwords for all smb users are revealed in plaintext on the smbserver.asp page. |
| CVE-2021-20163 | Media (4.9) | 0.79% | — | 30 dic 2021 | Trendnet AC2600 TEW-827DRU version 2.08B01 leaks information via the ftp web page. Usernames and passwords for all ftp users are revealed in plaintext on the ftpserver.asp page. |
| CVE-2021-20162 | Media (4.9) | 0.47% | — | 30 dic 2021 | Trendnet AC2600 TEW-827DRU version 2.08B01 stores credentials in plaintext. Usernames and passwords are stored in plaintext in the config files on the device. For example, /etc/config/cameo contains the admin password… |
| CVE-2021-20161 | Media (6.8) | 0.25% | — | 30 dic 2021 | Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient protections for the UART functionality. A malicious actor with physical access to the device is able to connect to the UART port via a serial… |
| CVE-2021-20160 | Alta (8.8) | 3.1% | — | 30 dic 2021 | Trendnet AC2600 TEW-827DRU version 2.08B01 contains a command injection vulnerability in the smb functionality of the device. The username parameter used when configuring smb functionality for the device is vulnerable… |
| CVE-2021-20159 | Alta (8.8) | 3.1% | — | 30 dic 2021 | Trendnet AC2600 TEW-827DRU version 2.08B01 is vulnerable to command injection. The system log functionality of the firmware allows for command injection as root by supplying a malformed parameter. |
| CVE-2021-20158 | Crítica (9.8) | 11% | — | 30 dic 2021 | Trendnet AC2600 TEW-827DRU version 2.08B01 contains an authentication bypass vulnerability. It is possible for an unauthenticated, malicous actor to force the change of the admin password due to a hidden administrative… |
| CVE-2021-20157 | Alta (7.5) | 1.5% | — | 30 dic 2021 | It is possible for an unauthenticated, malicious user to force the device to reboot due to a hidden administrative command. |
| CVE-2021-20156 | Media (6.5) | 0.41% | — | 30 dic 2021 | Trendnet AC2600 TEW-827DRU version 2.08B01 contains an improper access control configuration that could allow for a malicious firmware update. It is possible to manually install firmware that may be malicious in nature… |
| CVE-2021-20155 | Crítica (9.8) | 1.9% | — | 30 dic 2021 | Trendnet AC2600 TEW-827DRU version 2.08B01 makes use of hardcoded credentials. It is possible to backup and restore device configurations via the management web interface. These devices are encrypted using a hardcoded… |
| CVE-2021-20154 | Alta (7.5) | 0.77% | — | 30 dic 2021 | Trendnet AC2600 TEW-827DRU version 2.08B01 contains an security flaw in the web interface. HTTPS is not enabled on the device by default. This results in cleartext transmission of sensitive information such as passwords. |
| CVE-2021-20153 | Media (6.8) | 0.96% | — | 30 dic 2021 | Trendnet AC2600 TEW-827DRU version 2.08B01 contains a symlink vulnerability in the bittorrent functionality. If enabled, the bittorrent functionality is vulnerable to a symlink attack that could lead to remote code… |
| CVE-2021-20152 | Media (6.5) | 0.82% | — | 30 dic 2021 | Trendnet AC2600 TEW-827DRU version 2.08B01 lacks proper authentication to the bittorrent functionality. If enabled, anyone is able to visit and modify settings and files via the Bittorent web client by visiting:… |
| CVE-2021-20151 | Crítica (10) | 1.6% | — | 30 dic 2021 | Trendnet AC2600 TEW-827DRU version 2.08B01 contains a flaw in the session management for the device. The router's management software manages web sessions based on IP address rather than verifying client cookies/session… |
| CVE-2021-20150 | Media (5.3) | 40% | — | 30 dic 2021 | Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses information via redirection from the setup wizard. Authentication can be bypassed and a user may view information as Admin by manually browsing to the… |
| CVE-2021-20149 | Crítica (9.8) | 1.4% | — | 30 dic 2021 | Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient access controls for the WAN interface. The default iptables ruleset for governing access to services on the device only apply to IPv4. All services… |
| CVE-2020-14076 | Alta (8.8) | 2.6% | — | 15 jun 2020 | TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action… |
| CVE-2020-14081 | Alta (8.8) | 2.2% | — | 15 jun 2020 | TRENDnet TEW-827DRU devices through 2.06B04 contain multiple command injections in apply.cgi via the action send_log_email with the key auth_acname (or auth_passwd), allowing an authenticated user to run arbitrary… |
| CVE-2020-14080 | Crítica (9.8) | 2.3% | — | 15 jun 2020 | TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an unauthenticated user to execute arbitrary code by POSTing to apply_sec.cgi via the action… |
| CVE-2020-14079 | Alta (8.8) | 2.2% | — | 15 jun 2020 | TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action auto_up_fw… |
| CVE-2020-14078 | Alta (8.8) | 1.8% | — | 15 jun 2020 | TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action… |
| CVE-2020-14077 | Alta (8.8) | 1.8% | — | 15 jun 2020 | TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action… |
| CVE-2020-14075 | Alta (8.8) | 3.1% | — | 15 jun 2020 | TRENDnet TEW-827DRU devices through 2.06B04 contain multiple command injections in apply.cgi via the action pppoe_connect, ru_pppoe_connect, or dhcp_connect with the key wan_ifname (or wan0_dns), allowing an… |
| CVE-2020-14074 | Alta (8.8) | 1.8% | — | 15 jun 2020 | TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action… |
| CVE-2019-13279 | Crítica (9.8) | 2.7% | — | 10 jul 2019 | TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains multiple stack-based buffer overflows when processing user input for the setup wizard, allowing an unauthenticated user to execute arbitrary code.… |