CVE-2026-108804

Executive Summary

CVE-2026-108804 is a critical OS command injection vulnerability (CWE-77) affecting the TRENDnet TEW-751DR, TEW-752DRU, and TEW-733GR wireless routers running firmware versions 1.03B01 and 1.03B03. The flaw resides in the Web Management Backend component, specifically the manipulation of the service argument passed to the fwrite function within the pigwidgeon.cgi script, allowing an unauthenticated remote attacker to execute arbitrary operating system commands. With a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), the vulnerability represents maximum severity, and because the affected hardware reached End-of-Life in 2011, no vendor patch will ever be issued — victims must remove or isolate the devices entirely.

Technical Analysis

The vulnerability is classified as CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'). According to the NVD description, the affected code path is the Web Management Backend, implemented in the CGI script pigwidgeon.cgi. Within that script, the function fwrite is invoked while processing user-supplied input contained in the service argument.

The mechanics of this class of flaw are well understood: when CGI-based web management interfaces pass HTTP request parameters directly into shell command execution routines (for example, via system(), popen(), or exec() on the underlying embedded Linux operating system) without sanitization, an attacker can break out of the intended command context. Because the vulnerable parameter is named service, the exploit path is likely an HTTP request to the CGI endpoint with a crafted service value — although the exact request method (GET/POST) and URI are not disclosed in the available data. What is confirmed by the description is that the malicious input flows into fwrite after being read from the request, and the result is OS command execution on the device.

The attack is fully remote (AV:N) and requires no authentication (PR:N) and no user interaction (UI:N). The scope change flag (S:C) indicates that successful exploitation escapes the security boundary of the web application and compromises the underlying operating system. The impact subscores for confidentiality, integrity, and availability are all High (C:H/I:H/A:H), consistent with root-level command execution on a network edge device.

Because the vendor has publicly stated that these routers were EOL'd in 2011 and will not be tested or patched, the vulnerability is permanently unpatched. The description explicitly notes that the exploit is now public and may be used; however, no specific public PoC, exploit code, or Nuclei template was included in the source data. The EPSS score is not yet assigned by FIRST.org.

Exploitation Scenarios

This section describes the attack chain strictly at the vulnerability-class level based on the NVD description. No public PoC was identified; the sequence below is inferred from the confirmed facts (remote, unauthenticated CGI command injection via service argument) and standard OS command injection mechanics.

1. Reconnaissance / Target Identification. An attacker scans the internet for TRENDnet TEW-751DR, TEW-752DRU, or TEW-733GR devices with exposed web management interfaces. These are consumer/SOHO routers; exposed management panels are discoverable via Shodan searches using the product: and http.html: dorks listed in the metadata. Because the flaw is pre-authentication, merely reaching the web management backend is sufficient — no valid credentials are needed.

2. Triggering the Flaw. The attacker crafts an HTTP request directed at the Web Management Backend CGI script pigwidgeon.cgi. The service argument is populated with a value that includes shell metacharacters (e.g., ;, |, `, $()) intended to terminate the legitimate command and append an attacker-chosen command. Since the only confirmed detail is that the service argument, as handled by fwrite, is vulnerable, the precise parameter encoding and request structure are not specified in the available advisory. No further implementation detail can be stated without fabrication.

3. Payload / Execution. When the CGI script processes the request, the unsanitized service value is passed into the command execution context of the embedded OS. This results in arbitrary OS command injection — the attacker's command runs with the privileges of the web management process (typically root on embedded router firmware). The exact injection delimiter and command wrapper would depend on the internal implementation, which is not disclosed in the source data. It is acceptable to note that the practical exploit pattern follows the generic command-injection model, but no specific command string can be asserted from the description alone.

4. Post-Exploitation Impact. Given the CVSS vector (S:C, C:H/I:H/A:H), a successful exploit yields complete control of the router's operating system: reading and exfiltrating configuration and credential data, modifying firewall/NAT rules, establishing persistent backdoors, pivoting into the internal network, or enrolling the device into a botnet. Because the device sits on the network perimeter, its compromise undermines the confidentiality and integrity of all traffic and hosts behind it. The vendor's public confirmation that no fix will be produced means exploitation remains viable for the lifetime of every deployed unit.

Impact Assessment

The CVSS 3.1 base score is 10.0 — Critical. Subscores:

• Exploitability: Attack Vector Network (AV:N), Attack Complexity Low (AC:L), Privileges Required None (PR:N), User Interaction None (UI:N) — meaning any remote, unauthenticated party who can reach the web management interface can attempt exploitation without any preconditions.
• Impact: Scope Changed (S:C), Confidentiality High (C:H), Integrity High (I:H), Availability High (A:H) — full compromise of the device OS and everything it protects.

Business impact depends entirely on where these routers are deployed. In home offices, small businesses, retail, hospitality, and branch locations, the TEW-751DR/752DRU/733GR typically serve as the internet-facing gateway. Compromise therefore grants an attacker a privileged network position: traffic interception and manipulation, DNS/DHCP poisoning, lateral movement into internal hosts, and persistent remote access. A single exploited unit can function as a beachhead for broader intrusions.

Blast radius is constrained only by the number of devices in service and their exposure. Because these models are long past EOL (2011), they are unlikely to be inventoried in modern asset management systems, making them invisible risk. There is no CISA KEV listing and no EPSS score at this time, but the public exploit and permanent unpatchability elevate practical risk regardless of scoring. Organizations cannot remediate by patching — replacement is the only durable fix.

Detection Guidance

Sigma Rule

This rule detects command-injection attempts against the TRENDnet CGI endpoint by monitoring web/process telemetry for shell metacharacters in the service parameter.

title: TRENDnet Web Management Command Injection via pigwidgeon.cgi service parameter
id: 8b3f9a62-4c1e-4d0a-9f7b-2a6d5e1c8f90
status: experimental
description: Detects attempts to exploit CVE-2026-108804, OS command injection in TRENDnet TEW-751DR / TEW-752DRU / TEW-733GR via the service argument handled in pigwidgeon.cgi.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-108804
author: threat-intel
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains: 'pigwidgeon.cgi'
  selection_payload:
    cs-uri-query|contains:
      - 'service='
  selection_metachar:
    cs-uri-query|contains:
      - '%3B'
      - '%7C'
      - '%60'
      - '%24%28'
      - ';'
      - '|'
      - '`'
  condition: selection_uri and selection_payload and selection_metachar
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-method
falsepositives:
  - Legitimate administrative scripts containing encoded shell characters (rare)
level: critical

YARA Rule

Detects the vulnerable CGI binary/script artifacts and inline command-injection indicators on extracted firmware or filesystem images.

rule CVE_2026_108804_TRENDnet_CMDInjection
{
    meta:
        description = "Detects TRENDnet pigwidgeon.cgi command injection (CVE-2026-108804)"
        author = "threat-intel"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-108804"
        severity = "critical"

    strings:
        $cgi = "pigwidgeon.cgi" ascii wide nocase
        $svc = "service" ascii wide nocase
        $fw  = "fwrite" ascii wide
        $sh1 = "system(" ascii
        $sh2 = "popen(" ascii
        $m1  = ";%s" ascii
        $m2  = "|%s" ascii

    condition:
        uint16(0) == 0x7F45 or uint32(0) == 0x464C457F or $cgi
        and (2 of ($cgi, $svc, $fw, $sh1, $sh2))
        and any of ($m1, $m2)
}

(Note: the $m1/$m2 format-string indicators are generic command-injection markers; adjust to your firmware corpus. The confirmed facts are the pigwidgeon.cgi script and the service/fwrite code path.)

Suricata IDS Rule

Network rule flagging HTTP requests to pigwidgeon.cgi carrying shell metacharacters in the service parameter.

alert http any any -> any any (msg:"CVE-2026-108804 TRENDnet pigwidgeon.cgi OS Command Injection Attempt"; flow:established,to_server; http.uri; content:"pigwidgeon.cgi"; http.uri; content:"service="; http.uri; pcre:"/(%3B|%7C|%60|%24%28|;|\||`)/i"; classtype:web-application-attack; reference:cve,2026-108804; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-108804; sid:2026108804; rev:1;)

Elastic Detection

EQL rule correlating inbound web requests identifying the vulnerable endpoint with command-injection payload patterns.

sequence by source.ip with maxspan=5s
  [ network where network.protocol == "http"
      and url.path : "*pigwidgeon.cgi*"
      and url.query : "*service=*" ]
  [ network where network.protocol == "http"
      and url.query regex~ "(;|\\||`|\\$\\(|%3B|%7C|%60|%24%28)" ]

Splunk SPL Query

Assuming web access logs or proxy logs are ingested with a cs_uri_query / uri_query field.

index=web OR index=proxy
| eval uriq = coalesce(cs_uri_query, uri_query, url_query)
| where match(lower(uri_stem." ".uriqu), "pigwidgeon\\.cgi") AND match(uriqu, "service=")
| where match(uriqu, "(?i)(%3b|%7c|%60|%24%28|;|\\||`)")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(src_ip) as sources by uri_stem, uriqu
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

Custom rule detecting exploitation attempts observable in web server access logs monitored by Wazuh.

<group name="web,trendnet,cve_2026_108804,">
  <rule id="108804" level="12">
    <if_sid>31100</if_sid>
    <match>pigwidgeon.cgi</match>
    <regex>service=.*(%3b|%7c|%60|%24%28|;|\||`)</regex>
    <description>CVE-2026-108804: TRENDnet pigwidgeon.cgi OS command injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_108804,command_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor firmware fix exists or will exist; the affected products were EOL'd in 2011, and the vendor stated they cannot test for the vulnerability and will only notify customers of a potential issue. There is no upgrade path for these models.

1. Immediate mitigations.

   • Remove these routers from production and any internet-facing role; replace with a supported device. This is the only complete remediation.
   • If temporary retention is unavoidable: disable remote/web management access from the WAN (block TCP/80 and TCP/443 on the WAN interface at the upstream firewall), restrict administrative access to a trusted management VLAN, and never expose the web UI to the internet.
   • Segment any remaining units onto an isolated network with no access to sensitive internal subnets.

2. Patch / upgrade steps.

   • No firmware patch will be issued. The "upgrade" path is hardware replacement with a currently supported TRENDnet model or an alternative vendor's actively maintained router/firewall.
   • Since these units are undetectable via patch management, locate them via the Shodan dorks in METADATA and via network discovery (search for the web management UI and MAC/banner fingerprints), then decommission.

3. Long-term hardening.

   • Maintain a hardware lifecycle/asset inventory that flags EOL network gear before it becomes unsupported.
   • Adopt a policy prohibiting internet-exposed management interfaces on edge devices (management via VPN or out-of-band only).
   • Deploy the detection rules above on web/proxy/IDS telemetry to catch exploitation attempts against any residual units during decommissioning.
   • Monitor for vendor advisories and future CVEs against the same CGI component naming pattern (pigwidgeon.cgi) as researchers continue probing legacy firmware.

References

• NVD — CVE-2026-108804: https://nvd.nist.gov/vuln/detail/CVE-2026-108804
• CWE-77 — Improper Neutralization of Special Elements used in a Command ('Command Injection'): https://cwe.mitre.org/data/definitions/77.html
• TRENDnet product support / EOL notice (vendor confirms TEW-751DR, TEW-752DRU, TEW-733GR were EOL'd in 2011): https://www.trendnet.com/support/
• MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (verify current status; not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No specific threat actor campaign or confirmed in-the-wild exploitation has been publicly attributed to this CVE in the source data. The NVD description states the exploit is public and "may be used," but no PoC or exploit code was provided. EPSS has not yet scored this CVE via FIRST.org.