Critical · published January 7, 2026
🚨 Remote command injection in TRENDnet TEW-713RE devices! A little argument tweaking in the wrong function could let attackers take over your device entirely! 🔥 Think of it like a restaurant where the chef accepts any order without checking the menu. All it takes is a sneaky customer to issue a command, and suddenly they're whipping up whatever dish they want, regardless of the kitchen's rules! 🍽️ An attacker could remotely execute any command on your device, leading to disastrous outcomes such as data leaks, unauthorized access, or even total control over your network. It's a recipe for chaos if left unaddressed!
Think of it like a restaurant where the chef accepts any order without checking the menu. All it takes is a sneaky customer to issue a command, and suddenly they're whipping up whatever dish they want, regardless of the kitchen's rules! 🍽️ This vulnerability arises from improper input validation in the SZCMD argument of the /goformX/formFSrvX function, enabling OS command injection. With this flaw, an attacker can execute arbitrary commands on the device without needing any authentication.
An attacker could remotely execute any command on your device, leading to disastrous outcomes such as data leaks, unauthorized access, or even total control over your network. It's a recipe for chaos if left unaddressed! Although the product is discontinued and unsupported, it's crucial to isolate these devices from your network. If you're still using this router, consider replacing it with a supported model to ensure your network remains secure. 🛡️ You can tackle this! Stay proactive with your device management, and you'll be a security hero in no time! 💪✨
| Product | Versions | Fixed in |
|---|---|---|
| trendnet/tew-713re_firmware | all versions | — |