CVE-2025-15137

high · 7.4

A vulnerability was detected in TRENDnet TEW-800MB 1.0.1.0. Affected by this vulnerability is the function sub_F934 of the file NTPSyncWithHost.cgi. The manipulation results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

7.4

CVSS

11.4%

EPSS (exploit prob.)

96th

EPSS percentile

2025-12-28

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-74CWE-77

Affected products

Vendor	Product	Affected versions
trendnet	tew-800mb_firmware	1.0.1.0
trendnet	tew-800mb	all versions

Check a specific version with /api/v1/cve/match.

References

https://pentagonal-time-3a7.notion.site/TRENDnet-TEW-800MB-NTP-2c7e5dd4c5a580f999adcaff2c31978b
https://vuldb.com/?ctiid.338515
https://vuldb.com/?id.338515
https://vuldb.com/?submit.714241

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-15137