CVE-2024-28354: TRENDnet Tew-827dru Firmware

Critical severity, CVSS 10.0. EPSS: 2.2% chance of exploitation in the next 30 days.

There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. An attacker can inject commands into the post request parameters usapps.@smb[%d].username in the apply.cgi interface, thereby gaining root shell privileges.

Affected products

• TRENDnet Tew-827dru Firmware: version 2.10b01 only

Published 2024-03-15. Last modified 2026-06-17.