CVE-2021-20156

Trendnet AC2600 TEW-827DRU version 2.08B01 contains an improper access control configuration that could allow for a malicious firmware update

published December 30, 2021

CVSS
—
EPSS
0%
Percentile
33.7
In the wild
Unconfirmed
What it is

Trendnet AC2600 TEW-827DRU version 2.08B01 contains an improper access control configuration that could allow for a malicious firmware update. It is possible to manually install firmware that may be malicious in nature as there does not appear to be any signature validation done to determine if it is from a known and trusted source. This includes firmware updates that are done via the automated "check for updates" in the admin interface. If an attacker is able to masquerade as the update server, the device will not verify that the firmware updates downloaded are legitimate.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00406 · 33.7th percentile
Published
2021-12-30T21:31Z
EPSS history
Timeline
  • 30 DEC 21:31Z
    Trendnet AC2600 TEW-827DRU version 2.08B01 contains an improper access control configuration that could allow for a malicious firmware update
    cvelistv5