Cyber Posture

CVE-2026-5183

MediumPublic PoC

Published: 31 March 2026

Published
31 March 2026
Modified
30 April 2026
KEV Added
—
Patch
—
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0048 65.0th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was determined in TRENDnet TEW-713RE up to 1.02. The affected element is the function sub_421494 of the file /goform/addRouting. Executing a manipulation of the argument dest can lead to command injection. It is possible to launch the attack…

more

remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of the 'dest' argument in /goform/addRouting to block command injection payloads.

SI-2 Flaw Remediation good match
prevent

Mandates identification, reporting, and timely correction of the command injection flaw in sub_421494.

SI-9 Information Input Restrictions good match
prevent

Enforces restrictions on the 'dest' argument to deny shell metacharacters and prevent command injection.

Security SummaryAI

CVE-2026-5183 is a command injection vulnerability (CWE-74, CWE-77) affecting TRENDnet TEW-713RE wireless range extenders up to version 1.02. The flaw exists in the sub_421494 function of the /goform/addRouting file, where manipulation of the "dest" argument enables command injection. It carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2026-03-31.

The vulnerability is exploitable remotely by an attacker possessing low privileges (PR:L) with low attack complexity and no user interaction required. Successful exploitation allows injection and execution of arbitrary commands on the device, resulting in low-level impacts to confidentiality, integrity, and availability.

Advisories note that the exploit has been publicly disclosed via a GitHub repository and may be utilized by attackers. The vendor was contacted early about the issue but provided no response, and no patches or mitigations are mentioned in available references, including VulDB entries on the vulnerability details and related cyber threat intelligence.

Details

CWE(s)
CWE-74CWE-77

Affected Products

trendnet
tew-713re firmware
1.0.2

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
Why these techniques?

Command injection in the web management interface (/goform/addRouting) of a network device (wireless range extender) enables exploitation of public-facing applications (T1190), exploitation of remote services (T1210), and injection for network device CLI execution (T1059.008).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References