PT-2025-9122 · Trendnet · Trendnet Tew-929Dru
CVE-2025-25431
·
Published
2025-02-28
·
Updated
2025-04-30
CVSS v3.1
4.8
Medium
| Vector | AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Trendnet TEW-929DRU version 1.0.0.10
Description
The issue is related to a Stored Cross-site Scripting (XSS) vulnerability. This vulnerability can be exploited via the
ssid key of the wifi data parameter on the "/captive portal.htm" API endpoint.Recommendations
For Trendnet TEW-929DRU version 1.0.0.10, consider restricting access to the
/captive portal.htm page until a patch is available. As a temporary workaround, avoid using the ssid key in the wifi data parameter to minimize the risk of exploitation.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Trendnet Tew-929Dru