Cross Site Scripting Vulnerability in TRENDnet TEW-824DRU Web Interface
CVE-2026-4354

5.1MEDIUM

Key Information:

Vendor

Trendnet

Status
Tew-824dru
Vendor
CVE Published:
17 March 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-4354?

A Cross Site Scripting (XSS) vulnerability has been discovered in the TRENDnet TEW-824DRU's web interface, specifically within the apply_sec.cgi file's sub_420A78 function. Manipulating the Language argument allows for the execution of malicious scripts, which can be triggered remotely. The ease of exploitation, coupled with the public availability of the exploit, raises significant security concerns. Attempts to inform the vendor about the issue have gone unanswered, highlighting a potential risk for users of the affected firmware versions.

Affected Version(s)

TEW-824DRU 1.010B01

TEW-824DRU 1.04B01

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-4354 - Proof of Concept

References

https://vuldb.com/?id.351381
vdb-entrytechnical-description
https://vuldb.com/?ctiid.351381
signaturepermissions-required
https://vuldb.com/?submit.772660
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

iC0rner (VulDB User)
VulDB
.