CVE-2026-108804: TRENDnet Router RCE Vulnerability

CVE-2026-108804 Overview

CVE-2026-108804 is an operating system command injection vulnerability affecting TRENDnet TEW-751DR, TEW-752DRU, and TEW-733GR routers running firmware versions 1.03B01 and 1.03B03. The flaw resides in the fwrite function within the pigwidgeon.cgi script of the Web Management Backend. Attackers can manipulate the service argument to inject arbitrary operating system commands. The vulnerability is remotely exploitable without authentication, and public exploit code is already available. TRENDnet has confirmed the affected devices reached end-of-life (EOL) in 2011 and will not receive patches.

Critical Impact
Unauthenticated remote attackers can execute arbitrary OS commands on affected TRENDnet routers, enabling full device takeover. No vendor patch will be released because the devices are EOL.

Affected Products

TRENDnet TEW-751DR (firmware 1.03B01/1.03B03)
TRENDnet TEW-752DRU (firmware 1.03B01/1.03B03)
TRENDnet TEW-733GR (firmware 1.03B01/1.03B03)

Discovery Timeline

2026-10-12 - CVE-2026-108804 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-108804

Vulnerability Analysis

The vulnerability is classified under CWE-77: Improper Neutralization of Special Elements used in a Command. It exists in the fwrite function of the pigwidgeon.cgi component on the Web Management Backend of three TRENDnet consumer routers. The script accepts user-supplied input via the service parameter and incorporates it into a shell command without sufficient sanitization. An attacker who can reach the router's web interface can inject shell metacharacters and execute arbitrary commands with the privileges of the web server process, which typically runs as root on consumer-grade routers. Public exploit scripts for this vulnerability are hosted in the TRENDNet Exploits Repository, lowering the barrier for opportunistic abuse.

Root Cause

The root cause is unsafe handling of the service parameter inside pigwidgeon.cgi. User input flows into a command-execution context used by the fwrite function without allowlist validation or metacharacter escaping. Any string containing shell separators such as ;, |, backticks, or $() is interpreted by the underlying shell. Because the devices are no longer supported, the deficient input validation will not be remediated by the vendor.

Attack Vector

Exploitation requires only network access to the router's management interface and no authentication or user interaction. Attackers craft an HTTP request to the vulnerable CGI endpoint with a malicious service payload. The injected commands execute on the embedded Linux operating system, enabling attackers to pivot into the internal network, modify firmware or configuration, enlist the device into botnets, intercept traffic, or deploy persistent backdoors. If the web management interface is exposed to the internet, the exploit becomes trivially remote. See the VulDB entry for CVE-2026-108804 for additional technical context.

Detection Methods for CVE-2026-108804

Indicators of Compromise

HTTP POST or GET requests to /pigwidgeon.cgi containing shell metacharacters such as ;, |, &&, backticks, or $() in the service parameter.
Unexpected outbound connections from the router to attacker-controlled infrastructure following access to the web management interface.
Unauthorized modifications to router configuration, DNS settings, or firmware images.
New or unknown processes running on the embedded device after inbound requests to the CGI endpoint.

Detection Strategies

Inspect network traffic for HTTP requests targeting pigwidgeon.cgi with suspicious payloads in the service argument.
Monitor for inbound scanning against TCP ports exposed by the router's web management interface from untrusted networks.
Correlate router log entries with upstream firewall logs to identify command injection attempts and resulting outbound callbacks.

Monitoring Recommendations

Collect and centralize router syslog, DHCP, and DNS telemetry to detect anomalous queries and configuration drift.
Baseline normal management interface activity and alert on access attempts from outside administrative networks.
Monitor downstream clients behind affected routers for signs of man-in-the-middle activity, such as unexpected certificate changes or DNS redirection.

How to Mitigate CVE-2026-108804

Immediate Actions Required

Replace affected TEW-751DR, TEW-752DRU, and TEW-733GR devices with supported hardware, since no vendor patch is planned.
Disconnect the devices from the internet and disable remote management if replacement is not immediately possible.
Restrict access to the web management interface to a dedicated management VLAN or trusted IP addresses only.
Audit router configurations for unauthorized changes to DNS, firmware, or administrator credentials.

Patch Information

No patch is available. TRENDnet has stated: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product." The only durable remediation is hardware replacement with a supported router. Refer to the VulDB vulnerability record for ongoing updates.

Workarounds

Block external access to the router's HTTP/HTTPS management ports at the perimeter firewall or upstream ISP device.
Place affected routers behind a supported firewall and treat them as untrusted network segments.
Disable WAN-side administration and UPnP features to reduce the external attack surface.
Rotate administrative credentials and Wi-Fi pre-shared keys after isolating the device, in case prior compromise occurred.

bash

# Example: restrict management interface access to trusted hosts using an upstream iptables firewall
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -s <admin_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -s <admin_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP