PT-2026-78836

CVE-2026-76591

Published

2026-08-19

Updated

2026-08-21

Description by

CVSS 3.1

7.4

High

MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-755AP versions prior to 20260702

Description A command injection flaw exists in the ssi component within the /cgi-bin/email.cgi endpoint. The issue resides in the log email server() function, allowing a remote attacker to execute arbitrary commands through manipulation.

Recommendations Update TRENDnet TEW-755AP to a version released after 20260702. As a temporary mitigation, restrict access to the /cgi-bin/email.cgi endpoint.

Exploitability

Exploit

Fix

Impacts

Researchers

Fuhanhan2015

Vendors

Affected products

Weakness enumeration

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

Related identifiers