Command injection

TRENDnet TEW-827DRU devices through 2.06B04 contain multiple command injections in apply.cgi via the action pppoeconnect, rupppoeconnect, or dhcpconnect with the key wanifname or wan0dns, allowing an authenticated user to run arbitrary commands on the device...

CVE-2020-14075

Summary (CVE-2020-14075) TRENDnet TEW-827DRU routers (firmware up to 2.06B04) have a command-injection vulnerability in apply.cgi. The flaw is triggered by the actions pppoe_connect, ru_pppoe_connect, or dhcp_connect using the key wan_ifname (or wan0_dns), enabling an authenticated user to execut...

CVE-2020-14075: Improper Neutralization of Special Elements used in an OS Command

TRENDnet TEW-827DRU devices through 2.06B04 contain multiple command injections in apply.cgi via the action pppoeconnect, rupppoeconnect, or dhcpconnect with the key wanifname or wan0dns, allowing an authenticated user to run arbitrary commands on the device...