CVSS: 6.9EPSS: 0%CPEs: 2EXPL: 0CVE-2021-20153
https://notcve.org/view.php?id=CVE-2021-20153
Trendnet AC2600 TEW-827DRU version 2.08B01 contains a symlink vulnerability in the bittorrent functionality. If enabled, the bittorrent functionality is vulnerable to a symlink attack that could lead to remote code execution on the device. If an end user inserts a flash drive with a malicious symlink on it that the bittorrent client can write downloads to, then a user is able to download arbitrary files to any desired location on the devices filesystem, which could lead to remote code execution. Example directories vulnerable to this include "config", "downloads", and "torrents", though it should be noted that "downloads" is the only vector that allows for arbitrary files to be downloaded to arbitrary locations. Trendnet AC2600 TEW-827DRU versión 2.08B01, contiene una vulnerabilidad de symlink en la funcionalidad bittorrent. • https://www.tenable.com/security/research/tra-2021-54 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-20154
https://notcve.org/view.php?id=CVE-2021-20154
Trendnet AC2600 TEW-827DRU version 2.08B01 contains an security flaw in the web interface. HTTPS is not enabled on the device by default. This results in cleartext transmission of sensitive information such as passwords. Trendnet AC2600 TEW-827DRU versión 2.08B01, contiene un fallo de seguridad en la interfaz web. HTTPS no está habilitado en el dispositivo por defecto. • https://www.tenable.com/security/research/tra-2021-54 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-20152
https://notcve.org/view.php?id=CVE-2021-20152
Trendnet AC2600 TEW-827DRU version 2.08B01 lacks proper authentication to the bittorrent functionality. If enabled, anyone is able to visit and modify settings and files via the Bittorent web client by visiting: http://192.168.10.1:9091/transmission/web/ Trendnet AC2600 TEW-827DRU versión 2.08B01, carece de la autenticación apropiada para la funcionalidad bittorrent. Si está habilitada, cualquiera puede visitar y modificar la configuración y los archivos por medio del cliente web de Bittorent al visitar: http://192.168.10.1:9091/transmission/web/ • https://www.tenable.com/security/research/tra-2021-54 • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2021-20159
https://notcve.org/view.php?id=CVE-2021-20159
Trendnet AC2600 TEW-827DRU version 2.08B01 is vulnerable to command injection. The system log functionality of the firmware allows for command injection as root by supplying a malformed parameter. Trendnet AC2600 TEW-827DRU versión 2.08B01, es vulnerable a una inyección de comandos. La funcionalidad system log del firmware permite una inyección de comandos como root al suministrar un parámetro malformado. • https://www.tenable.com/security/research/tra-2021-54 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 2%CPEs: 2EXPL: 0CVE-2021-20158
https://notcve.org/view.php?id=CVE-2021-20158
Trendnet AC2600 TEW-827DRU version 2.08B01 contains an authentication bypass vulnerability. It is possible for an unauthenticated, malicous actor to force the change of the admin password due to a hidden administrative command. Trendnet AC2600 TEW-827DRU versión 2.08B01, contiene una vulnerabilidad de omisión de autenticación. Es posible que un actor malicioso no autenticado fuerce el cambio de la contraseña de administrador debido a un comando administrativo oculto. • https://www.tenable.com/security/research/tra-2021-54 • CWE-306: Missing Authentication for Critical Function •