CVE-2025-8731: TRENDnet Default Credentials Vulnerability

CVE-2025-8731 Overview

A default credentials vulnerability has been identified in multiple TRENDnet network devices including the TI-G160i, TI-PG102i, and TPL-430AP. This vulnerability affects the SSH Service component, where the presence of default credentials could allow unauthorized remote access to affected devices. The vulnerability enables attackers to potentially gain administrative access to network infrastructure devices through the SSH service.

Critical Impact

Remote attackers may be able to authenticate to vulnerable TRENDnet devices using default credentials via SSH, potentially gaining complete control over network switches and access points.

Affected Products

• TRENDnet TI-G160i (firmware versions up to 20250724)
• TRENDnet TI-PG102i (firmware versions up to 20250724)
• TRENDnet TPL-430AP (firmware versions up to 20250724)

Discovery Timeline

• August 8, 2025 - CVE-2025-8731 published to NVD
• August 13, 2025 - Last updated in NVD database

Technical Details for CVE-2025-8731

Vulnerability Analysis

This vulnerability is classified under CWE-1392 (Use of Default Credentials). The affected TRENDnet devices contain a root account in the SSH service that uses default or preset credentials. While the vendor has stated that remote management options are disabled by default on the TI-PG102i and TI-G160i models and that the root password is encrypted, the presence of a root account with known or predictable credentials presents a security risk if remote management is ever enabled.

For the TPL-430AP, the vendor indicates that the initial setup process requires users to set a password for the management GUI, which should invalidate the default password. However, the SSH service may still be vulnerable if this setup process is not completed or if there are configuration inconsistencies.

The real existence of this vulnerability is currently disputed by the vendor. TRENDnet has announced plans to remove the root account from future firmware releases as a precautionary measure.

Root Cause

The root cause of this vulnerability stems from the presence of a default root account in the SSH service of affected TRENDnet devices. While designed for troubleshooting purposes, the existence of such accounts with known or default credentials violates security best practices for network infrastructure devices. Default credentials represent a systemic security weakness that has been documented across numerous IoT and network device categories.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no user interaction or prior authentication. An attacker with network access to the SSH service (typically port 22) on a vulnerable device could attempt to authenticate using default or commonly known credentials associated with TRENDnet devices. If successful, the attacker would gain root-level access to the device, enabling them to:

• Modify network configurations
• Intercept network traffic
• Pivot to other devices on the network
• Install persistent backdoors
• Disrupt network operations

The exploitation requires the SSH service to be accessible, which the vendor states is disabled by default on some models. However, devices with intentionally or inadvertently enabled SSH services remain at risk.

Detection Methods for CVE-2025-8731

Indicators of Compromise

• Unexpected SSH authentication successes to TRENDnet devices, particularly using the root account
• Configuration changes on TRENDnet switches or access points without authorized administrator activity
• SSH connection attempts from unusual source IP addresses targeting network infrastructure devices
• Presence of unfamiliar user accounts or modified system configurations on affected devices

Detection Strategies

• Monitor network logs for SSH authentication attempts targeting TRENDnet device IP addresses
• Implement network segmentation to restrict SSH access to management networks only
• Deploy intrusion detection rules to alert on SSH connections to known TRENDnet device addresses from unauthorized sources
• Conduct regular audits of device configurations to identify unauthorized changes

Monitoring Recommendations

• Enable comprehensive logging on all network infrastructure devices and forward logs to a centralized SIEM
• Configure alerts for successful SSH logins to TRENDnet devices, especially outside maintenance windows
• Monitor for lateral movement attempts originating from network device IP addresses
• Implement baseline configuration monitoring to detect unauthorized modifications

How to Mitigate CVE-2025-8731

Immediate Actions Required

• Audit all TRENDnet TI-G160i, TI-PG102i, and TPL-430AP devices in your environment
• Verify that SSH remote management is disabled on all affected devices unless absolutely required
• If SSH access is necessary, implement strong access controls including IP allowlisting and VPN requirements
• Change default credentials on all TRENDnet devices and ensure strong, unique passwords are configured
• Complete the initial setup process on TPL-430AP devices to invalidate default passwords

Patch Information

TRENDnet has acknowledged the reported vulnerability and has indicated that the root account will be removed in upcoming firmware releases. Administrators should monitor TRENDnet's support page for firmware updates addressing this issue. Until patches are available, implement the recommended workarounds and access controls.

For additional technical details, see the GitHub Vulnerability Report and the VulDB entry.

Workarounds

• Disable SSH service on affected devices if remote management is not required
• Implement network segmentation to isolate management interfaces from general network traffic
• Use firewall rules to restrict SSH access to trusted administrator IP addresses only
• Enable additional authentication mechanisms such as certificate-based authentication where supported
• Monitor for unauthorized access attempts and configure alerts for suspicious SSH activity

# Example: Restrict SSH access using iptables on upstream firewall
# Allow SSH only from trusted management subnet
iptables -A FORWARD -d <trendnet_device_ip> -p tcp --dport 22 -s 10.0.1.0/24 -j ACCEPT
iptables -A FORWARD -d <trendnet_device_ip> -p tcp --dport 22 -j DROP