TRENDnet admits critical remote code injection flaw in three unsupported routers
TRENDnet confirms a critical vulnerability in three legacy routers, stating it cannot test or fix the devices because they were discontinued in 2011.
Key points
- TRENDnet TEW-751DR, TEW-752DRU and TEW733GR routers contain a critical remote command injection flaw in their web management backend.
- The National Vulnerability Database assigns CVE-2026-108804 a CVSS score of 10, rating the severity as critical due to remote exploitability.
- The vendor states the devices reached end-of-life in 2011, meaning no security patches or testing capabilities are available to address the issue.
TRENDnet has confirmed the existence of a critical security vulnerability in three specific models of wireless routers. The company acknowledged the flaw after researchers identified a way for attackers to execute arbitrary commands on the devices remotely. Because these routers are no longer supported, the vendor cannot provide a software update to fix the problem.
In plain English
The flaw, tracked as CVE-2026-108804, allows an attacker to send malicious data to the router’s web management interface. Specifically, the issue lies in how the `pigwidgeon.cgi` file processes the `service` argument. When this argument is manipulated, it triggers an operating system command injection. This means an attacker can trick the router into running system commands remotely, according to the NVD record.
The background
The National Vulnerability Database describes the weakness using CWE-78 and CWE-77, which relate to improper neutralization of special elements in commands. The affected devices are the TRENDnet TEW-751DR, TEW-752DRU and TEW733GR. All three models are vulnerable when running firmware versions 1.03B01 or 1.03B03. The exploit code is now public, according to the NVD record, meaning anyone can attempt to use it against these devices.
What changes now
TRENDnet explicitly stated that these routers were declared end-of-life in 2011. Consequently, the company has no ability to test whether the vulnerability exists in other contexts or to develop a fix. The vendor’s only action is to notify customers of the potential risk. Users of these specific models must assume their devices are vulnerable and take manual steps to reduce exposure, as no official patch will ever be released.
What to do and how to stay safe: TRENDnet
- Isolate affected TRENDnet routers from the internet by disabling WAN connections or removing them from the network entirely.
- Replace unsupported hardware with modern routers that receive regular security updates and vendor support.
- Review network logs for unusual outbound traffic or unauthorized commands originating from the affected devices.
- Disable remote management features on any legacy networking equipment to limit exposure to external attackers.
Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which TRENDnet routers are affected by CVE-2026-108804?
The TRENDnet TEW-751DR, TEW-752DRU and TEW733GR routers running firmware versions 1.03B01 or 1.03B03 are affected.
Is there a software update available to fix this vulnerability?
No, TRENDnet confirmed the devices were end-of-life in 2011 and stated it has no way to test or fix the vulnerability.
What type of attack does this vulnerability enable?
It enables remote operating system command injection through the web management backend, allowing attackers to run commands on the device.
