CVE-2026-108804

Summary

A critical OS command injection vulnerability exists in TRENDnet routers due to improper input sanitization in the pigwidgeon.cgi web management backend, allowing remote attackers to execute arbitrary commands with high privileges.

Exploitability

Exploitation is straightforward with no authentication required, leveraging a remote command injection flaw that can be triggered through the service parameter in the fwrite function of pigwidgeon.cgi.

Blast radius

The vulnerability affects all affected TRENDnet router models still connected to the internet, potentially enabling full system compromise and persistent backdoor access for attackers.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Immediate remediation requires upgrading to firmware version 1.03B04 or later, as this is the first fixed version specifically mentioned in the vendor's advisory for these affected models.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.