CVE-2026-5355
Published: 02 April 2026
Summary
CVE-2026-5355 is a medium-severity Command Injection (CWE-77) vulnerability in Trendnet Tew-657Brm Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 9.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SC-7 (Boundary Protection).
Deeper analysis
A vulnerability has been identified in the Trendnet TEW-657BRM router running firmware version 1.00.1. The issue resides in the vpn_drop function within the /setup.cgi file, where improper handling of the policy_name argument permits OS command injection. The flaw is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 5.3.
An authenticated remote attacker can supply a crafted policy_name value to execute arbitrary operating system commands on the device. Publicly available proof-of-concept code demonstrates that the attack can be performed over the network without user interaction, potentially allowing an adversary to alter device configuration, exfiltrate data, or disrupt service.
The vendor has stated that the TEW-657BRM reached end-of-life status in June 2011 and receives no further support or patches. No firmware updates or official mitigations are available; the vendor intends only to post a notice on its product support page and notify registered owners.
EPSS for the CVE rose from a low baseline to a recorded peak of 0.0106, indicating increased exploitation interest after public disclosure of the proof-of-concept.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-18412
Vulnerability details
A vulnerability has been found in Trendnet TEW-657BRM 1.00.1. Affected by this issue is the function vpn_drop of the file /setup.cgi. The manipulation of the argument policy_name leads to os command injection. The attack is possible to be carried out…
more
remotely. The exploit has been disclosed to the public and may be used. The vendor confirms, that "[t]he product in question (...) has been discontinued and end of life since June 23, 2011, that is more than 14 years ago. We no longer provide support for this product, so we are not able to confirm the vulnerabilities. We will make an announcement on our website's product support page and notify customers who registered their products with us." This vulnerability only affects products that are no longer supported by the maintainer.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in web CGI (/setup.cgi) on public-facing router web interface directly enables T1190 (Exploit Public-Facing Application). Exploitation grants arbitrary OS command execution on network device, facilitating T1059.008 (Network Device CLI).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires disabling or removing unsupported EOL system components like the Trendnet TEW-657BRM to eliminate exposure to this unpatchable OS command injection vulnerability.
Information input validation on the policy_name argument in the vpn_drop function of /setup.cgi directly prevents OS command injection by rejecting malformed or malicious inputs.
Boundary protection at network interfaces blocks remote access to the vulnerable /setup.cgi endpoint, stopping exploitation over the network.