CVE-2026-5183
Published: 31 March 2026
Summary
CVE-2026-5183 is a medium-severity Injection (CWE-74) vulnerability in Trendnet Tew-713Re Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 34.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of the 'dest' argument in /goform/addRouting to block command injection payloads.
Mandates identification, reporting, and timely correction of the command injection flaw in sub_421494.
Enforces restrictions on the 'dest' argument to deny shell metacharacters and prevent command injection.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in the web management interface (/goform/addRouting) of a network device (wireless range extender) enables exploitation of public-facing applications (T1190), exploitation of remote services (T1210), and injection for network device CLI execution (T1059.008).
NVD Description
A vulnerability was determined in TRENDnet TEW-713RE up to 1.02. The affected element is the function sub_421494 of the file /goform/addRouting. Executing a manipulation of the argument dest can lead to command injection. It is possible to launch the attack…
more
remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2026-5183 is a command injection vulnerability (CWE-74, CWE-77) affecting TRENDnet TEW-713RE wireless range extenders up to version 1.02. The flaw exists in the sub_421494 function of the /goform/addRouting file, where manipulation of the "dest" argument enables command injection. It carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2026-03-31.
The vulnerability is exploitable remotely by an attacker possessing low privileges (PR:L) with low attack complexity and no user interaction required. Successful exploitation allows injection and execution of arbitrary commands on the device, resulting in low-level impacts to confidentiality, integrity, and availability.
Advisories note that the exploit has been publicly disclosed via a GitHub repository and may be utilized by attackers. The vendor was contacted early about the issue but provided no response, and no patches or mitigations are mentioned in available references, including VulDB entries on the vulnerability details and related cyber threat intelligence.
Details
- CWE(s)