PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-5354 Trendnet CVE debrief

CVE-2026-5354 is a low-severity OS command injection vulnerability in Trendnet TEW-657BRM 1.00.1. The vulnerability affects the vpn_connect function of the /setup.cgi file and can be exploited remotely. Trendnet has discontinued support for this product, which reached its end-of-life on June 23, 2011. Security teams should assess and mitigate this vulnerability, prioritizing compensating controls like network segmentation and access restrictions. Although the product is discontinued, it may still be in use within certain networks, requiring careful review and monitoring for potential exploitation attempts and anomalous activity.

Vendor
Trendnet
Product
TEW-657BRM
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-02
Original CVE updated
2026-07-24
Advisory published
2026-04-02
Advisory updated
2026-07-24

Who should care

Security teams responsible for maintaining legacy Trendnet TEW-657BRM devices should prioritize assessing and mitigating this vulnerability. Although the product is discontinued and no longer supported by the vendor, it may still be in use within certain networks.

Technical summary

The vulnerability exists in the vpn_connect function of the /setup.cgi file in Trendnet TEW-657BRM 1.00.1. An attacker can exploit this vulnerability by manipulating the policy_name argument, leading to OS command injection. The vulnerability has a CVSS score of 2.1 and is classified as low severity. Trendnet confirms that the product has been discontinued and end-of-life since June 23, 2011, and they no longer provide support for this product. The vendor will make an announcement on their website's product support page and notify customers who registered their products.

Defensive priority

Low priority, as the product is discontinued and no longer supported by the vendor.

Recommended defensive actions

  • Inventory and assess the presence of Trendnet TEW-657BRM devices within your network.
  • Implement compensating controls, such as network segmentation or access restrictions, to limit the attack surface.
  • Consider replacing discontinued devices with supported alternatives.
  • Monitor for potential exploitation attempts and anomalous activity.
  • Review and update incident response plans to address potential exploitation of this vulnerability.

Evidence notes

The CVE record was published on 2026-04-02T17:16:32.287Z and last modified on 2026-07-24T20:10:00.147Z. The NVD entry is currently Analyzed. The vendor confirms that the product has been discontinued and end-of-life since June 23, 2011.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-5354 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-5354

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-5354 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-5354

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.