CVE-2026-5353
Published: 02 April 2026
Summary
CVE-2026-5353 is a medium-severity Command Injection (CWE-77) vulnerability in Trendnet Tew-657Brm Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 9.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SI-10 (Information Input Validation).
Deeper analysis
A vulnerability has been identified in the Trendnet TEW-657BRM router running firmware version 1.00.1. The issue resides in the ping_test function within the /setup.cgi file, where improper handling of the c4_IPAddr argument permits operating system command injection. The flaw is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 5.3.
An authenticated remote attacker can supply a crafted c4_IPAddr value to execute arbitrary commands on the device. Because a public exploit is already available, the attack can be carried out over the network without user interaction once valid credentials are obtained.
The vendor has stated that the TEW-657BRM reached end-of-life in June 2011, is no longer supported, and that no patches or firmware updates will be issued. The product support page will be updated and registered owners notified.
EPSS for the CVE rose from a baseline of 0.0033 to a peak of 0.0106 after disclosure, indicating increased exploitation interest in the period following publication.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-18408
Vulnerability details
A vulnerability was detected in Trendnet TEW-657BRM 1.00.1. Affected is the function ping_test of the file /setup.cgi. Performing a manipulation of the argument c4_IPAddr results in os command injection. Remote exploitation of the attack is possible. The exploit is now…
more
public and may be used. The vendor confirms, that "[t]he product in question (...) has been discontinued and end of life since June 23, 2011, that is more than 14 years ago. We no longer provide support for this product, so we are not able to confirm the vulnerabilities. We will make an announcement on our website's product support page and notify customers who registered their products with us." This vulnerability only affects products that are no longer supported by the maintainer.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection via public-facing web CGI (/setup.cgi) on a network device (router) directly enables exploitation of public-facing applications (T1190) and execution of commands via Network Device CLI or Unix Shell (T1059.008).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Prohibits the use of unsupported system components like this EOL router that cannot be patched for the OS command injection vulnerability.
Requires validation of inputs such as the c4_IPAddr argument to prevent OS command injection in the ping_test function.
Mandates identification and remediation of flaws like this command injection, leading to patching or retirement of the affected EOL product.