TRENDnet Tew-929dru Firmware vulnerabilities

4 CVEs affecting TRENDnet Tew-929dru Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-25429, published 2025-02-28.

More from TRENDnet.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-25428, published 2025-02-28. High severity, CVSS 8.0. EPSS: 0.4% chance of exploitation in the next 30 days. TRENDnet TEW-929DRU 1.0.0.10 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.
• CVE-2025-25429, published 2025-02-28. Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days. Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the r_name variable inside the have_same_name function on the /addschedule.htm page.
• CVE-2025-25431, published 2025-02-28. Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days. Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the The ssid key of wifi_data parameter on the /captive_portal.htm page.
• CVE-2025-25430, published 2025-02-28. Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days. Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the configname parameter on the /cbi_addcert.htm page.