CVE-2026-5355: Trendnet TEW-657BRM RCE Vulnerability

CVE-2026-5355 Overview

CVE-2026-5355 is an operating system (OS) command injection vulnerability in the Trendnet TEW-657BRM wireless router running firmware version 1.00.1. The flaw resides in the vpn_drop function within /setup.cgi, where the policy_name argument is passed to a shell context without proper sanitization [CWE-77]. An authenticated remote attacker can manipulate this parameter to execute arbitrary OS commands on the device. Trendnet has confirmed the product reached end-of-life on June 23, 2011, and will not receive a patch. The exploit details have been disclosed publicly through VulDB and a GitHub repository.

Critical Impact
Authenticated attackers can inject arbitrary OS commands through the policy_name parameter on an unsupported device that will never receive a vendor fix.

Affected Products

Trendnet TEW-657BRM hardware
Trendnet TEW-657BRM firmware version 1.00.1
All units in service (product discontinued and end-of-life since June 23, 2011)

Discovery Timeline

2026-04-02 - CVE-2026-5355 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-5355

Vulnerability Analysis

The Trendnet TEW-657BRM exposes a web management interface that includes a VPN policy management endpoint at /setup.cgi. The vpn_drop function processes requests intended to remove VPN policies and accepts a user-controlled policy_name argument. The function passes this argument into a shell command without input validation or escaping. As a result, shell metacharacters such as ;, |, `, and $() are interpreted by the underlying shell instead of being treated as literal data. The vulnerability is reachable over the network and requires only low-privileged authentication to the device, making any router with default or compromised credentials exploitable.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-77]. The CGI handler concatenates the policy_name value directly into a system command string. Embedded firmware of this generation commonly invokes helpers such as system(), popen(), or backtick subshells in BusyBox without sanitization, which is consistent with the behavior described in the public proof of concept.

Attack Vector

An attacker with valid web interface credentials sends a crafted HTTP request to /setup.cgi invoking the vpn_drop action. The policy_name parameter carries the injected shell payload. Because the device runs the web server as the system account, injected commands execute with elevated privileges on the router. Successful exploitation enables persistence, traffic interception, credential theft from connected clients, and pivoting into the internal network.

No verified exploit code is reproduced here. Technical details and a proof of concept are documented at the GitHub VPN Drop Exploit writeup and the VulDB Vulnerability Report #354708.

Detection Methods for CVE-2026-5355

Indicators of Compromise

HTTP POST or GET requests to /setup.cgi containing the vpn_drop action with shell metacharacters (;, |, `, $(), &&) in the policy_name parameter.
Outbound connections from the router management IP to unexpected external hosts following administrative sessions.
Unscheduled configuration changes, new firewall rules, or modified DNS settings on the device.

Detection Strategies

Inspect web traffic destined for router management interfaces for setup.cgi requests containing non-alphanumeric characters in policy_name.
Alert on authenticated administrative sessions to legacy SOHO routers originating from non-administrative subnets or external addresses.
Correlate router-originated DNS queries and outbound flows against baselines, since command injection often spawns child processes that beacon outward.

Monitoring Recommendations

Forward router syslog and NetFlow data to a centralized analytics platform and retain it long enough to investigate slow-burn compromises.
Maintain an inventory of network equipment that has passed vendor end-of-life so unsupported devices are continuously flagged for replacement.
Monitor for DHCP, ARP, and DNS anomalies on segments served by the TEW-657BRM to detect downstream client redirection.

How to Mitigate CVE-2026-5355

Immediate Actions Required

Remove the Trendnet TEW-657BRM from production networks. The vendor confirmed the product is end-of-life since June 23, 2011, and no patch will be issued.
Disable remote management on the WAN interface and restrict the LAN-side administrative interface to a dedicated management VLAN.
Rotate the administrative password and any pre-shared keys used by VPN policies on the device, since low-privileged credentials are sufficient for exploitation.

Patch Information

No patch is available. Trendnet stated on its product support page that the TEW-657BRM has been discontinued for more than 14 years and that the vendor will not confirm or remediate the vulnerabilities. Replacement with a currently supported router is the only complete fix. Refer to the VulDB Vulnerability Report #354708 for the latest vendor statement.

Workarounds

Place the device behind an upstream firewall that blocks inbound access to TCP/80 and TCP/443 on the router's management interface from untrusted networks.
Enforce strong, unique administrative credentials and disable any default or shared accounts to reduce the population of attackers who can reach the authenticated endpoint.
Segment the router so that any compromise cannot reach sensitive internal systems, and accelerate hardware replacement planning.

bash

# Example upstream firewall rule (iptables) to block external access
# to the legacy router's web management interface
iptables -A FORWARD -p tcp -d <ROUTER_IP> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <ROUTER_IP> --dport 443 -j DROP