CVE-2021-20151: Critical severity trendnet tew-827dru vulnerability
Trendnet AC2600 TEW-827DRU version 2.08B01 contains a flaw in the session management for the device. The router's management software manages web sessions based on IP address rather than verifying client cookies/session tokens/etc. This allows an attacker (whether from a different computer, different web browser on the same machine, etc.) to take over an existing session. This does require the attacker to be able to spoof or take over original IP address of the original user's session.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-20151?
CVE-2021-20151 is rated as a high severity vulnerability due to improper session management.
How do I fix CVE-2021-20151?
To fix CVE-2021-20151, update the Trendnet TEW-827DRU firmware to the latest version provided by the manufacturer.
What devices are affected by CVE-2021-20151?
CVE-2021-20151 affects the Trendnet TEW-827DRU router running firmware version 2.08B01.
What type of attack is possible due to CVE-2021-20151?
CVE-2021-20151 allows attackers to potentially hijack web sessions by exploiting the reliance on IP address for session management.
Is there a workaround for CVE-2021-20151?
There are no known workarounds for CVE-2021-20151, it is recommended to update to the patched firmware as the primary mitigation.