CVE-2025-15472

CVE-2025-15472 is an operating system command injection flaw in the httpd service of the TRENDnet TEW-811DRU router, located in the setDeviceURL function reached through the uapply.cgi endpoint. An attacker triggers it by submitting a crafted DeviceURL parameter to the router's web interface, and per the CVSS 4.0 vector (PR:H) the attack requires privileges at the administrator level, so it presumes valid access to the management interface. Successful exploitation yields remote command execution on the device with high impact to confidentiality, integrity, and availability, effectively giving the attacker control of the router. Only firmware version 1.0.2.0 is named in the disclosure, the vendor was contacted early but did not respond, and no fixed release is documented. A public proof of concept exists, the EPSS score of 22.6% (98th percentile) indicates a meaningful likelihood of exploitation within 30 days, but the flaw is not in CISA KEV and no confirmed in-the-wild exploitation is reported.

What to do: Because the vendor reportedly did not respond and no fixed firmware is documented, owners should verify their TEW-811DRU firmware version and ensure the router's web management interface is not reachable from the WAN (disable remote administration). If remote management is required, restrict access to trusted source addresses or tunnel it via VPN, and monitor TRENDnet support channels for an updated firmware release. Review the published proof of concept to confirm whether the DeviceURL handling in uapply.cgi is reachable in your deployment.