CVE-2025-15472 TRENDnet TEW-811DRU httpd uapply.cgi setDeviceURL os command injection
Remote attackers can execute arbitrary OS commands via the DeviceURL parameter in the httpd service of TRENDnet TEW-811DRU routers.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-15472?
CVE-2025-15472 is a high-severity command injection vulnerability in TRENDnet TEW-811DRU, published on 6 Jan 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A flaw has been found in TRENDnet TEW-811DRU 1.0.2.0. This affects the function setDeviceURL of the file uapply.cgi of the component httpd . This manipulation of the argument DeviceURL causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Which versions are affected by CVE-2025-15472?
It affects 1 product.
Products include Trendnet Tew-811dru Firmware.
How do I fix CVE-2025-15472?
No fix has been published for CVE-2025-15472 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-15472 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-15472 exists.
Other vulnerabilities in TRENDnet TEW-811DRU
- CVE-2023-0612 TRENDnet TEW-811DRU httpd basic.asp buffer overflow
- CVE-2023-0613 TRENDnet TEW-811DRU httpd security.asp memory corruption
- CVE-2023-0617 TRENDNet TEW-811DRU httpd guestnetwork.asp buffer overflow
- CVE-2023-0638 TRENDnet TEW-811DRU Web Interface command injection
- CVE-2023-0637 TRENDnet TEW-811DRU Web Management Interface wan.asp memory corruption
Sources
Also known as GHSA-g6rc-w49h-g45h.