CVE-2024-36729
Published Jun 3, 2024TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing…
Vendor/product archive
trendnet / tew-827dru CVEs
Beta · best-effort42 CVEs tagged to trendnet / tew-827dru — 9 Critical, 24 High, 9 Medium, 0 Low, 0 Unrated.
CVE-2024-36728
Published Jun 3, 2024TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing…
CVE-2024-28354
Published Mar 15, 2024There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. An attacker can inject commands into the post request parameters usapps…
CVE-2024-28353
Published Mar 15, 2024There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. An attacker can inject commands into the post request parameters usapps…
CVE-2021-20165
Published Dec 30, 2021Trendnet AC2600 TEW-827DRU version 2.08B01 does not properly implement csrf protections. Most pages lack proper usage of CSRF protections or mitigations. Additionally, pages that…
CVE-2021-20164
Published Dec 30, 2021Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses credentials for the smb functionality of the device. Usernames and passwords for all smb users are revealed in plai…
CVE-2021-20163
Published Dec 30, 2021Trendnet AC2600 TEW-827DRU version 2.08B01 leaks information via the ftp web page. Usernames and passwords for all ftp users are revealed in plaintext on the ftpserver.asp page.
CVE-2021-20162
Published Dec 30, 2021Trendnet AC2600 TEW-827DRU version 2.08B01 stores credentials in plaintext. Usernames and passwords are stored in plaintext in the config files on the device. For example, /etc/co…
CVE-2021-20161
Published Dec 30, 2021Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient protections for the UART functionality. A malicious actor with physical access to the device is able to connect…
CVE-2021-20160
Published Dec 30, 2021Trendnet AC2600 TEW-827DRU version 2.08B01 contains a command injection vulnerability in the smb functionality of the device. The username parameter used when configuring smb func…
CVE-2021-20159
Published Dec 30, 2021Trendnet AC2600 TEW-827DRU version 2.08B01 is vulnerable to command injection. The system log functionality of the firmware allows for command injection as root by supplying a mal…
CVE-2021-20158
Published Dec 30, 2021Trendnet AC2600 TEW-827DRU version 2.08B01 contains an authentication bypass vulnerability. It is possible for an unauthenticated, malicous actor to force the change of the admin…
CVE-2021-20157
Published Dec 30, 2021It is possible for an unauthenticated, malicious user to force the device to reboot due to a hidden administrative command.
CVE-2021-20156
Published Dec 30, 2021Trendnet AC2600 TEW-827DRU version 2.08B01 contains an improper access control configuration that could allow for a malicious firmware update. It is possible to manually install f…
CVE-2021-20155
Published Dec 30, 2021Trendnet AC2600 TEW-827DRU version 2.08B01 makes use of hardcoded credentials. It is possible to backup and restore device configurations via the management web interface. These d…
CVE-2021-20154
Published Dec 30, 2021Trendnet AC2600 TEW-827DRU version 2.08B01 contains an security flaw in the web interface. HTTPS is not enabled on the device by default. This results in cleartext transmission of…
CVE-2021-20153
Published Dec 30, 2021Trendnet AC2600 TEW-827DRU version 2.08B01 contains a symlink vulnerability in the bittorrent functionality. If enabled, the bittorrent functionality is vulnerable to a symlink at…
CVE-2021-20152
Published Dec 30, 2021Trendnet AC2600 TEW-827DRU version 2.08B01 lacks proper authentication to the bittorrent functionality. If enabled, anyone is able to visit and modify settings and files via the B…
CVE-2021-20151
Published Dec 30, 2021Trendnet AC2600 TEW-827DRU version 2.08B01 contains a flaw in the session management for the device. The router's management software manages web sessions based on IP address rath…
CVE-2021-20150
Published Dec 30, 2021Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses information via redirection from the setup wizard. Authentication can be bypassed and a user may view information a…
CVE-2021-20149
Published Dec 30, 2021Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient access controls for the WAN interface. The default iptables ruleset for governing access to services on the dev…
CVE-2020-14076
Published Jun 15, 2020TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing…
CVE-2020-14081
Published Jun 15, 2020TRENDnet TEW-827DRU devices through 2.06B04 contain multiple command injections in apply.cgi via the action send_log_email with the key auth_acname (or auth_passwd), allowing an a…
CVE-2020-14080
Published Jun 15, 2020TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an unauthenticated user to execute arbitrary code by POSTi…
CVE-2020-14079
Published Jun 15, 2020TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing…
Showing 1-25 of 42 CVEsPage 1 of 2