Key points
- CVE-2026-108804 allows remote OS command injection via the pigwidgeon.cgi file.
- The flaw affects three specific TRENDnet router models running firmware 1.03B01 or 1.03B03.
- TRENDnet confirms the products were end-of-life in 2011 and cannot be tested or patched.
TRENDnet has acknowledged a critical vulnerability in three older router models that are no longer supported. The National Vulnerability Database lists the issue as CVE-2026-108804, with a CVSS score of 10, indicating severe risk.
The flaw resides in the Web Management Backend component, specifically within the fwrite function of the pigwidgeon.cgi file. Attackers can manipulate the service argument to result in OS command injection. This allows for remote exploitation, and public exploit code is currently available for use.
Context and background
The vulnerability stems from improper handling of input data, classified under CWE-78 and CWE-77 weaknesses. These categories relate to OS command injection issues where user-controlled data is passed to system commands. The NVD record highlights that the attack vector is remote, meaning no local access is required to trigger the flaw.
TRENDnet stated that the affected routers were declared end-of-life in 2011. Because the hardware is discontinued, the vendor lacks the ability to test for the existence of the vulnerability or develop a fix. The company confirmed it would notify customers of the potential risk but offered no remediation path.
Who is affected
The issue impacts three specific TRENDnet devices: the TEW-751DR, TEW-752DRU, and TEW733GR. Only units running firmware versions 1.03B01 or 1.03B03 are vulnerable. The NVD record explicitly notes that this vulnerability only affects products that are no longer supported by the maintainer, limiting the scope to legacy deployments.
What happens next
Organisations using these legacy devices should assume they are at risk if connected to untrusted networks. Since no patch exists, the only effective mitigation is physical removal from the network. Security teams should audit their inventory for these specific model numbers and firmware versions to identify exposure.
What to do and how to stay safe: TRENDnet
- Check device firmware versions against the affected list (1.03B01/1.03B03) for TEW-751DR, TEW-752DRU, and TEW733GR models.
- Isolate affected routers from the internet immediately to prevent remote exploitation using the public code.
- Plan to replace unsupported hardware with modern, actively maintained networking equipment.
- Monitor network logs for unusual outbound traffic that may indicate command injection attempts.
Step-by-step guide: Patch Management Policy: How to Automate Fixes Without Breaking Systems
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is there a patch for CVE-2026-108804?
No, TRENDnet confirmed the products were end-of-life in 2011 and cannot be patched or tested.
Which TRENDnet routers are vulnerable?
The TEW-751DR, TEW-752DRU, and TEW733GR running firmware 1.03B01 or 1.03B03 are affected.
Can this flaw be exploited remotely?
Yes, the NVD record states the attack can be launched remotely via the web management backend.
