CVE-2026-5354
Published: 02 April 2026
Summary
CVE-2026-5354 is a medium-severity Command Injection (CWE-77) vulnerability in Trendnet Tew-657Brm Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 9.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SI-10 (Information Input Validation).
Deeper analysis
A flaw has been identified in the Trendnet TEW-657BRM router running firmware 1.00.1. The issue resides in the vpn_connect function within /setup.cgi, where unsanitized input to the policy_name argument permits OS command injection. The vulnerability is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 5.3.
An authenticated remote attacker can supply a crafted policy_name value to execute arbitrary operating-system commands on the device. Public exploit code has been released, and the attack requires no user interaction beyond low-privileged network access.
The vendor has stated that the TEW-657BRM reached end-of-life in June 2011 and receives no further support or patches; affected units remain exposed with no official remediation path.
EPSS for the CVE rose from a low baseline to a recorded peak of 0.0106, indicating measurable post-disclosure interest in exploitation despite the product’s unsupported status.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-18410
Vulnerability details
A flaw has been found in Trendnet TEW-657BRM 1.00.1. Affected by this vulnerability is the function vpn_connect of the file /setup.cgi. Executing a manipulation of the argument policy_name can lead to os command injection. The attack can be executed remotely.…
more
The exploit has been published and may be used. The vendor confirms, that "[t]he product in question (...) has been discontinued and end of life since June 23, 2011, that is more than 14 years ago. We no longer provide support for this product, so we are not able to confirm the vulnerabilities. We will make an announcement on our website's product support page and notify customers who registered their products with us." This vulnerability only affects products that are no longer supported by the maintainer.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in public-facing web CGI (/setup.cgi) enables T1190 (Exploit Public-Facing Application) for remote exploitation and T1059.004 (Unix Shell) for arbitrary OS command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly validates untrusted inputs like the policy_name argument in vpn_connect to prevent OS command injection exploitation.
Prohibits or replaces unsupported EOL components such as the Trendnet TEW-657BRM firmware vulnerable to this unpatchable command injection flaw.
Establishes processes to identify, report, and remediate flaws like this CVE through mitigation strategies including isolation or decommissioning since patching is unavailable.