PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-5354 Trendnet CVE debrief

CVE-2026-5354 is a low-severity OS command injection vulnerability in Trendnet TEW-657BRM 1.00.1. The vulnerability affects the vpn_connect function of the /setup.cgi file and can be exploited remotely. Trendnet has discontinued support for this product, which reached its end-of-life on June 23, 2011. Security teams should assess and mitigate this vulnerability, prioritizing compensating controls like network segmentation and access restrictions. Although the product is discontinued, it may still be in use within certain networks, requiring careful review and monitoring for potential exploitation attempts and anomalous activity.

Vendor
Trendnet
Product
TEW-657BRM
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-02
Original CVE updated
2026-07-24
Advisory published
2026-04-02
Advisory updated
2026-07-24

Who should care

Security teams responsible for maintaining legacy Trendnet TEW-657BRM devices should prioritize assessing and mitigating this vulnerability. Although the product is discontinued and no longer supported by the vendor, it may still be in use within certain networks.

Technical summary

The vulnerability exists in the vpn_connect function of the /setup.cgi file in Trendnet TEW-657BRM 1.00.1. An attacker can exploit this vulnerability by manipulating the policy_name argument, leading to OS command injection. The vulnerability has a CVSS score of 2.1 and is classified as low severity. Trendnet confirms that the product has been discontinued and end-of-life since June 23, 2011, and they no longer provide support for this product. The vendor will make an announcement on their website's product support page and notify customers who registered their products.

Defensive priority

Low priority, as the product is discontinued and no longer supported by the vendor.

Recommended defensive actions

  • Inventory and assess the presence of Trendnet TEW-657BRM devices within your network.
  • Implement compensating controls, such as network segmentation or access restrictions, to limit the attack surface.
  • Consider replacing discontinued devices with supported alternatives.
  • Monitor for potential exploitation attempts and anomalous activity.
  • Review and update incident response plans to address potential exploitation of this vulnerability.

Evidence notes

The CVE record was published on 2026-04-02T17:16:32.287Z and last modified on 2026-07-24T20:10:00.147Z. The NVD entry is currently Analyzed. The vendor confirms that the product has been discontinued and end-of-life since June 23, 2011.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-02T17:16:32.287Z and has not been modified since then. The NVD entry is currently Analyzed.