High severity · published Dec 30, 2021
CVE-2021-20165
Trendnet AC2600 TEW-827DRU version 2.08B01 does not properly implement csrf protections
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
Trendnet AC2600 TEW-827DRU version 2.08B01 does not properly implement csrf protections. Most pages lack proper usage of CSRF protections or mitigations. Additionally, pages that do make use of CSRF tokens are trivially bypassable as the server does not appear to validate them properly (i.e. re-using an old token or finding the token thru some other method is possible).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TF
Tew-827dru Firmware · Trendnet
2.08b01 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-20165
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-20165
Exploit
https://www.tenable.com/security/research/tra-2021-54
More from Tew-827dru Firmware
10.0
CVE-2024-28354
There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01
10.0
CVE-2021-20151
Trendnet AC2600 TEW-827DRU version 2.08B01 contains a flaw in the session management for the device
9.8
CVE-2021-20158
Trendnet AC2600 TEW-827DRU version 2.08B01 contains an authentication bypass vulnerability
9.8
CVE-2021-20155
Trendnet AC2600 TEW-827DRU version 2.08B01 makes use of hardcoded credentials
9.8
CVE-2021-20149
Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient access controls for the WAN interface