CVE-2026-5183: TRENDnet TEW-713RE addRouting command injection
A command injection vulnerability was published for the TRENDnet TEW-713RE up to 1.02, located in the sub_421494 function that handles the /goform/addRouting path. The record states that manipulating the dest argument can be exploited remotely, and that a public exploit reference exists. No fixed version is listed and the vendor did not respond to early disclosure.
Overview
The record describes a command injection flaw in the sub_421494 function, reached through the /goform/addRouting path of the TRENDnet TEW-713RE, in versions up to and including 1.02. According to the record, manipulating the dest argument can lead to command injection and the attack can be launched remotely.
Impact
- If exploited, command injection may allow an attacker to run unintended commands on the device. The exact resulting privileges and effects are not described in the record.
- NVD lists a critical base score of 9.8, with a vector indicating network access, low complexity, no privileges and no user interaction required.
- Other scoring providers in the record give lower values, including 5.3 and 6.3, so the severity depends on the scoring source.
- The record classifies the weakness as CWE-74 (Injection).
Affected products and versions
- TRENDnet TEW-713RE, up to and including 1.02.
- The record also lists a firmware entry for the same product written as 1.0.2.
- No fixed version is listed in the record. This does not confirm that no fix exists.
Exploitation status
- The record does not list this CVE in the CISA KEV catalog, so no confirmed active exploitation is recorded in the sources consulted.
- The record states that the exploit has been publicly disclosed and may be used, and it references a third-party repository tagged as an exploit. This does not establish that attacks are occurring in the wild.
- The SSVC exploitation field is set to proof of concept, and the EPSS probability is 0.08894 with a percentile of 0.95229, as given in the record.
Remediation and mitigation
- The record indicates the vendor did not respond to early disclosure, so an official patch should not be assumed.
- Restrict access to the device web administration interface to trusted internal networks, and do not expose it to the internet.
- Check whether the device is still supported by the vendor. If no update path exists, plan replacement or decommissioning.
- Monitor the vendor and the referenced advisories for any future fix.
Detection guidance
- Review web server or device logs for requests to the /goform/addRouting path, especially from unexpected or external sources.
- Look for unusual configuration changes on routing settings and for unexpected outbound connections from the device.
- Treat any suspicious activity on affected devices as a potential compromise and investigate accordingly.
Limitations of the available information
- The record does not provide a fixed version, a vendor advisory or confirmed vendor acknowledgement.
- The record does not describe the privileges the injected commands would run with, or the full set of impacts.
- Scores differ between providers and CVSS versions, and the record does not explain the differences.
- Exploitation evidence is limited to the existence of a public exploit reference and the SSVC and EPSS fields.
Frequently asked questions
Is this TRENDnet vulnerability being actively exploited?
The record does not list this CVE in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted. The record does state that a public exploit has been disclosed.
Is there a fixed firmware version?
No fixed version is listed in the record, and the vendor did not respond to early disclosure. Restrict access to the device and check whether the vendor still supports it.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.