CVE-2025-15136: TRENDnet TEW-800MB Management wizardset do_setWizard_asp command injection
A security vulnerability has been detected in TRENDnet TEW-800MB 1.0.1.0. Affected is the function dosetWizardasp of the file /goform/wizardset of the component Management Interface. The manipulation of the argument WizardConfigured leads to command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15136?
The severity of CVE-2025-15136 is categorized as critical due to the potential for command injection.
How do I fix CVE-2025-15136?
To fix CVE-2025-15136, it is recommended to apply the latest firmware update provided by TRENDnet for the TEW-800MB.
What is affected by CVE-2025-15136?
CVE-2025-15136 affects the TRENDnet TEW-800MB device specifically in its Management Interface.
What type of vulnerability is CVE-2025-15136?
CVE-2025-15136 is classified as a command injection vulnerability due to improper handling of user-supplied input.
Can CVE-2025-15136 be exploited remotely?
Yes, CVE-2025-15136 can be exploited remotely if an attacker has network access to the vulnerable TRENDnet TEW-800MB device.