CVE-2021-20161

CVE-2021-20161 affects Trendnet AC2600 TEW-827DRU (v2.08B01). The root cause is insufficient protections for the UART functionality, enabling a physically proximate attacker to connect via the UART port, with no credentials required, granting a root shell and full device control. CVSS details: CV...

CVE-2021-20162

The CVE-2021-20162 entries describe a vulnerability in Trendnet AC2600 TEW-827DRU (v2.08B01) where credentials are stored in plaintext in device configuration files. Specifically, usernames and passwords are stored in plaintext on the device, with an example path: /etc/config/cameo containing the...

CVE-2021-20162

Trendnet AC2600 TEW-827DRU version 2.08B01 stores credentials in plaintext. Usernames and passwords are stored in plaintext in the config files on the device. For example, /etc/config/cameo contains the admin password in plaintext...

CVE-2021-20161

Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient protections for the UART functionality. A malicious actor with physical access to the device is able to connect to the UART port via a serial connection. No username or password is required and the user is given a root shell with...

CVE-2021-20160

The CVE-2021-20160 entry concerns Trendnet AC2600 TEW-827DRU (firmware 2.08B01) with a command injection flaw in the SMB configuration flow. The vulnerability arises from the username parameter used when configuring SMB functionality, enabling an attacker with network access to inject commands as...

CVE-2021-20160

Trendnet AC2600 TEW-827DRU version 2.08B01 contains a command injection vulnerability in the smb functionality of the device. The username parameter used when configuring smb functionality for the device is vulnerable to command injection as root...

CVE-2021-20155

The CVE-2021-20155 entry applies to Trendnet AC2600 TEW-827DRU (firmware 2.08B01). The vulnerability arises from hardcoded credentials used to encrypt configuration data and the ability to back up/restore device configurations via the management web interface, exposing potential exposure of confi...

CVE-2021-20155

Trendnet AC2600 TEW-827DRU version 2.08B01 makes use of hardcoded credentials. It is possible to backup and restore device configurations via the management web interface. These devices are encrypted using a hardcoded password of "12345678"...

CVE-2021-20154

CVE-2021-20154 affects Trendnet AC2600 TEW-827DRU (firmware 2.08B01). The root cause is that the device’s web interface does not enable HTTPS by default, allowing cleartext transmission of sensitive data (e.g., passwords) over the network. Affected component is the web interface; impact is exposu...

CVE-2021-20153

CVE-2021-20153 affects Trendnet AC2600 TEW-827DRU (firmware version 2.08B01). The issue is a symlink vulnerability in the bittorrent functionality that could allow a remote code execution on the device. If a user inserts a flash drive containing a malicious symlink that the bittorrent client can ...

CVE-2021-20153

Trendnet AC2600 TEW-827DRU version 2.08B01 contains a symlink vulnerability in the bittorrent functionality. If enabled, the bittorrent functionality is vulnerable to a symlink attack that could lead to remote code execution on the device. If an end user inserts a flash drive with a malicious...

CVE-2021-20154

Trendnet AC2600 TEW-827DRU version 2.08B01 contains an security flaw in the web interface. HTTPS is not enabled on the device by default. This results in cleartext transmission of sensitive information such as passwords...

CVE-2021-20152

CVE-2021-20152 affects Trendnet AC2600 TEW-827DRU (firmware 2.08B01). The vulnerability arises from lack of proper authentication to the Bittorrent functionality; when enabled, an unauthenticated attacker can visit the Bittorrent web client UI and modify settings/files via http://192.168.10.1:909...

CVE-2021-20152

Trendnet AC2600 TEW-827DRU version 2.08B01 lacks proper authentication to the bittorrent functionality. If enabled, anyone is able to visit and modify settings and files via the Bittorent web client by visiting: http://192.168.10.1:9091/transmission/web/...

CVE-2021-20159

The CVE affects Trendnet AC2600 TEW-827DRU firmware version 2.08B01; the system log functionality is vulnerable to command injection, allowing root-level execution via a malformed parameter. This is evidenced by Red Hat, CNVD, NVD and CVE records citing the same issue. Root cause: improper handli...

CVE-2021-20159

Trendnet AC2600 TEW-827DRU version 2.08B01 is vulnerable to command injection. The system log functionality of the firmware allows for command injection as root by supplying a malformed parameter...

CVE-2021-20158

Trendnet AC2600 TEW-827DRU (firmware 2.08B01) contains an authentication bypass vulnerability via a hidden administrative command, allowing an unauthenticated attacker with network access to force a change of the admin password. Documented in multiple sources (NVD entry CVE-2021-20158 and Nuclei ...

CVE-2021-20158

Trendnet AC2600 TEW-827DRU version 2.08B01 contains an authentication bypass vulnerability. It is possible for an unauthenticated, malicous actor to force the change of the admin password due to a hidden administrative command...

CVE-2021-20156

The CVE-2021-20156 entry concerns Trendnet AC2600 TEW-827DRU (firmware version 2.08B01) with improper access control that could let an attacker install malicious firmware. The vulnerability arises from lack of signature validation for firmware updates, including those delivered via the admin inte...

CVE-2021-20156

Trendnet AC2600 TEW-827DRU version 2.08B01 contains an improper access control configuration that could allow for a malicious firmware update. It is possible to manually install firmware that may be malicious in nature as there does not appear to be any signature validation done to determine if i...