CVE-2026-7606: trendnet tew-821dap_firmware
Vulnerability summary
CVE-2026-7606 is a high (CVSS 8.1) vulnerability in trendnet tew-821dap_firmware. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22.5% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 02-05-2026PublishedVulnerability first disclosed.
- 04-05-2026Last modifiedVulnerability information updated.
Description
A weakness has been identified in TRENDnet TEW-821DAP 1.12B01. This issue affects the function find_hwid/new_gui_update_firmware of the component Firmware Update Handler. Executing a manipulation of the argument dest can lead to insufficient verification of data authenticity. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The vendor explains: "That firmware version will only work on our hardware version v1.xR. We have already EOL that product 8 years ago and are no longer selling". This vulnerability only affects products that are no longer supported by the maintainer.
CVSS metrics
7 scores · 2 sources · 4 versions- NVDNIST6.3MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVE.orgCNA3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:RDiffers
- NVDNIST2.6LowAV:N/AC:H/Au:N/C:N/I:P/A:N
EPSS trend
Probability
0.31%
Chance of exploitation in the next 30 days
Percentile
23%
Versus all other CVEs
30-day change
+0.08 pp
From 0.23% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundIot Firmware Update
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Trendnet1 product
- tew-821dap_firmware1.12B01 | 1.12b01
1 vendor · 1 product
References
4 links- github.com/IOTRes/IOT_Firmware_Update/blob/main/Trendnet/TEW-821DAP_Auth.mdPatchExploitThird Party Advisory