{"id":"CVE-2024-0920","aliases":["EUVD-2024-16701","GHSA-988v-v47j-cj4p"],"status":"published","title":"TRENDnet TEW-822DRE POST Request admin_ping.htm command injection","description":"A vulnerability was found in TRENDnet TEW-822DRE 1.03B02. It has been declared as critical. This vulnerability affects unknown code of the file /admin_ping.htm of the component POST Request Handler. The manipulation of the argument ipv4_ping/ipv6_ping leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252124. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.08648,"percentile":0.95155,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-77"],"published":"2024-01-26T08:08:36Z","modified":"2026-06-17T06:54:34Z","products":[{"vendor":"trendnet","product":"tew-822dre"},{"vendor":"trendnet","product":"tew-822dre_firmware"}],"references":[{"url":"https://vuldb.com/?id.252124","tags":["vdb-entry","technical-description","x_transferred","Third Party Advisory"]},{"url":"https://vuldb.com/?ctiid.252124","tags":["signature","permissions-required","x_transferred","Permissions Required","Third Party Advisory"]},{"url":"https://warp-desk-89d.notion.site/TEW-822DRE-5289eb95796749c2878843519ab451d8?pvs=4","tags":["exploit","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-0920"},{"url":"https://github.com/advisories/GHSA-988v-v47j-cj4p"}],"sources":{"cve":[{"id":"CVE-2024-0920","title":"TRENDnet TEW-822DRE POST Request admin_ping.htm command injection","description":"A vulnerability was found in TRENDnet TEW-822DRE 1.03B02. It has been declared as critical. This vulnerability affects unknown code of the file /admin_ping.htm of the component POST Request Handler. The manipulation of the argument ipv4_ping/ipv6_ping leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252124. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2024-01-26T08:08:36.975Z","modified":"2025-06-17T14:27:29.228Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"},{"version":"3.0","score":7.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"},{"version":"2.0","score":8.3,"vector":"AV:N/AC:L/Au:M/C:C/I:C/A:C","assessor":"cna"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:34:22.852179Z"}],"euvd":[{"id":"EUVD-2024-16701","description":"A vulnerability was found in TRENDnet TEW-822DRE 1.03B02. It has been declared as critical. This vulnerability affects unknown code of the file /admin_ping.htm of the component POST Request Handler. The manipulation of the argument ipv4_ping/ipv6_ping leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252124. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2024-01-26T08:08:36Z","modified":"2025-06-17T14:27:29Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:22.732364Z"}],"ghsa":[{"id":"GHSA-988v-v47j-cj4p","title":"A vulnerability was found in TRENDnet TEW-822DRE 1.03B02. It has been declared as critical. This...","description":"A vulnerability was found in TRENDnet TEW-822DRE 1.03B02. It has been declared as critical. This vulnerability affects unknown code of the file /admin_ping.htm of the component POST Request Handler. The manipulation of the argument ipv4_ping/ipv6_ping leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252124. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2024-01-26T09:30:23Z","modified":"2024-01-26T09:30:29Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:55:29.55339Z"}],"nvd":[{"id":"CVE-2024-0920","description":"A vulnerability was found in TRENDnet TEW-822DRE 1.03B02. It has been declared as critical. This vulnerability affects unknown code of the file /admin_ping.htm of the component POST Request Handler. The manipulation of the argument ipv4_ping/ipv6_ping leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252124. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2024-01-26T09:15:08.293Z","modified":"2026-06-17T06:54:34.147Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":8.3,"vector":"AV:N/AC:L/Au:M/C:C/I:C/A:C","level":"high","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:09:32.147098Z"}]}}