CVE Intelligence
Analysis AI-assisted

CVE-2026-108804: TRENDnet TEW-751DR/752DRU/733GR pigwidgeon.cgi OS Command Injection

A critical OS command injection flaw affects the fwrite function in pigwidgeon.cgi of the Web Management Backend on TRENDnet TEW-751DR, TEW-752DRU and TEW733GR devices (firmware 1.03B01/1.03B03). The issue is reachable remotely via the service argument and a public exploit exists. These are end-of-life products no longer supported by the vendor.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-108804 is an operating system command injection vulnerability (CWE-77) in the Web Management Backend of several TRENDnet routers. According to the record, the flaw resides in the fwrite function of the file pigwidgeon.cgi, where the service argument is not safely handled, allowing injection of operating system commands.

The affected devices are the TRENDnet TEW-751DR, TEW-752DRU and TEW733GR running firmware 1.03B01 and 1.03B03. The vulnerability was assigned by VulDB and carries a maximum CVSS 3.1 base score of 10.0.

Impact

Successful exploitation allows a remote attacker to execute arbitrary operating system commands on the affected device without authentication or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) indicates network reachability, low complexity, no privileges required, a scope change, and high impact to confidentiality, integrity and availability. In practice, this level of access can lead to full device compromise.

Affected Products and Versions

  • TRENDnet TEW-751DR — firmware 1.03B01 and 1.03B03
  • TRENDnet TEW-752DRU — firmware 1.03B01 and 1.03B03
  • TRENDnet TEW733GR — firmware 1.03B01 and 1.03B03

The vendor states these products were end-of-life (EOL'd in 2011 per the quoted statement) and are no longer supported, meaning official testing and fixes are not available.

Exploitation Status

The record indicates that a public exploit exists and may be used. However, this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed exploitation in the wild appears in the sources consulted. The EPSS score for this CVE was approximately 0.024 (around the 83rd percentile) as of 2026-10-13, which estimates the likelihood of exploitation activity but is not evidence of it.

Remediation and Mitigation

No official fixed version is listed in the record, and the vendor indicates the products are end-of-life and unsupported. Given that context, defensive measures focus on reducing exposure:

  • Treat these devices as unsupported and plan replacement with currently supported hardware.
  • Ensure the web management interface is never exposed to the internet or untrusted networks.
  • Restrict management access to trusted administrative hosts and segment the devices on isolated networks.
  • Disable remote administration features where possible.

Detection Guidance

  • Monitor for unexpected or unauthorized access to the device web management interface, particularly requests involving pigwidgeon.cgi.
  • Watch for anomalous outbound connections or unusual process activity that could indicate command execution on the device.
  • Review network logs for management access from unexpected source addresses.

Limitations of the Available Information

The available sources are primarily the VulDB entry and third-party exploit references. No vendor patch, fixed firmware version, or CISA KEV listing is present. The description does not detail the exact authentication context beyond the CVSS vector indicating no privileges required, and no independent confirmation of in-the-wild exploitation is provided in the consulted sources.

Frequently asked questions

What is CVE-2026-108804?

It is a critical OS command injection vulnerability (CWE-77) in the fwrite function of pigwidgeon.cgi in the Web Management Backend of TRENDnet TEW-751DR, TEW-752DRU and TEW733GR routers running firmware 1.03B01/1.03B03. It can be exploited remotely via the service argument.

Is there a fix available?

No fixed version is listed in the record. The vendor states these products are end-of-life and no longer supported, so official patches are not expected. The recommended path is to replace the devices with supported hardware.

Is this vulnerability being actively exploited?

The record notes a public exploit exists, but the vulnerability is not listed in the CISA KEV catalog and no confirmed exploitation in the wild appears in the sources consulted.

How severe is it?

VulDB assigned a CVSS 3.1 base score of 10.0 (critical), reflecting remote, unauthenticated exploitation with high impact to confidentiality, integrity and availability.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.