CVE-2026-5184

CVE-2026-5184 is a command injection vulnerability affecting TRENDnet TEW-713RE devices running firmware versions up to 1.02. The issue resides in an unknown function within the /goform/setSysAdm file, where manipulation of the "admuser" argument enables arbitrary command execution. Classified under CWE-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-77 (Command Injection), it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating medium severity.

The vulnerability can be exploited remotely by attackers who possess low privileges (PR:L), requiring no user interaction and low attack complexity over the network. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling attackers to execute arbitrary commands on the device, such as altering configurations or running unauthorized processes within the context of the affected function.

Advisories from VulDB and related references, including a GitHub repository, document the issue but provide no vendor patches or mitigations, as TRENDnet was contacted early without response. The exploit is publicly available, increasing the risk of active use against unpatched devices.

In notable context, the public disclosure of the exploit on GitHub suggests potential for real-world exploitation, though no specific in-the-wild activity is confirmed in available data.