CVE-2025-15136

high · 7.4

A security vulnerability has been detected in TRENDnet TEW-800MB 1.0.1.0. Affected is the function do_setWizard_asp of the file /goform/wizardset of the component Management Interface. The manipulation of the argument WizardConfigured leads to command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

7.4

CVSS

10.7%

EPSS (exploit prob.)

96th

EPSS percentile

2025-12-28

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-74CWE-77

Affected products

Vendor	Product	Affected versions
trendnet	tew-800mb_firmware	1.0.1.0
trendnet	tew-800mb	all versions

Check a specific version with /api/v1/cve/match.

References

https://pentagonal-time-3a7.notion.site/TRENDnet-TEW-800MB-2c7e5dd4c5a58067bc81e530bf3191c0
https://vuldb.com/?ctiid.338514
https://vuldb.com/?id.338514
https://vuldb.com/?submit.714042

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-15136