{"id":"CVE-2024-22545","aliases":["EUVD-2024-20081","GHSA-phwp-w9r4-qjpx"],"status":"published","title":"TRENDnet TEW-824DRU version 1.04b01 is vulnerable to Command Injection via the system.ntp.server...","description":"An issue was discovered in TRENDnet TEW-824DRU version 1.04b01, allows unauthenticated attackers to execute arbitrary code via the system.ntp.server parameter in the sub_420AE0() function. The attack can be launched remotely.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00498,"percentile":0.43054,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-77"],"published":"2024-01-26T00:00:00Z","modified":"2026-06-17T07:11:32Z","products":[{"vendor":"trendnet","product":"tew-824dru_firmware"}],"references":[{"url":"https://warp-desk-89d.notion.site/TEW-824DRU-e7228d462ce24fa1a9fecb0bee57caad","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22545"},{"url":"https://github.com/advisories/GHSA-phwp-w9r4-qjpx"}],"sources":{"cve":[{"id":"CVE-2024-22545","description":"An issue was discovered in TRENDnet TEW-824DRU version 1.04b01, allows unauthenticated attackers to execute arbitrary code via the system.ntp.server parameter in the sub_420AE0() function. The attack can be launched remotely.","status":"published","published":"2024-01-26T00:00:00Z","modified":"2025-05-29T15:17:53.946Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:34:00.254134Z"}],"euvd":[{"id":"EUVD-2024-20081","description":"An issue was discovered in TRENDnet TEW-824DRU version 1.04b01, allows unauthenticated attackers to execute arbitrary code via the system.ntp.server parameter in the sub_420AE0() function. The attack can be launched remotely.","status":"published","published":"2024-01-26T00:00:00Z","modified":"2025-05-29T15:17:53Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:35.425302Z"}],"ghsa":[{"id":"GHSA-phwp-w9r4-qjpx","title":"TRENDnet TEW-824DRU version 1.04b01 is vulnerable to Command Injection via the system.ntp.server...","description":"TRENDnet TEW-824DRU version 1.04b01 is vulnerable to Command Injection via the system.ntp.server in the sub_420AE0() function.","status":"published","published":"2024-01-26T09:30:23Z","modified":"2024-02-11T05:07:57Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:55:35.698137Z"}],"nvd":[{"id":"CVE-2024-22545","description":"An issue was discovered in TRENDnet TEW-824DRU version 1.04b01, allows unauthenticated attackers to execute arbitrary code via the system.ntp.server parameter in the sub_420AE0() function. The attack can be launched remotely.","status":"published","published":"2024-01-26T08:15:42.48Z","modified":"2026-06-17T07:11:32.47Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:09:32.147098Z"}]}}