High severity · published Aug 19, 2026
CVE-2026-76591
TRENDnet TEW-755AP ssi email.cgi log_email_server command injection
7.4
CVSS
1.8%
EPSS
No
On KEV
Description
A security flaw has been discovered in TRENDnet TEW-755AP up to 20260702. This affects the function log_email_server of the file /cgi-bin/email.cgi of the component ssi. Performing a manipulation results in command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TE
TEW-755AP · TRENDnet
20260702 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-76591
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-76591
github.com
https://github.com/meishigana/CVE/blob/main/team15_20260702/14_755ap-ssi-cmdi/poc/poc-ssi-injection.py
github.com
https://github.com/meishigana/CVE/tree/main/team15_20260702/14_755ap-ssi-cmdi
vuldb.com
https://vuldb.com/cve/CVE-2026-76591
vuldb.com
https://vuldb.com/submit/877853
vuldb.com
https://vuldb.com/vuln/393088
vuldb.com
https://vuldb.com/vuln/393088/cti
More from TEW-755AP
9.9
CVE-2026-76590
TRENDnet TEW-755AP ssi wan.cgi stack-based overflow
9.9
CVE-2026-76589
TRENDnet TEW-755AP mycli FUN_401000 stack-based overflow
9.8
CVE-2022-46601
TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the setbg_num parameter in the icp_setbg_img (sub_41DD68) function
9.8
CVE-2022-46600
TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the wps_sta_enrollee_pin parameter in the action set_sta_enrollee_pin_24g function
9.8
CVE-2022-46599
TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the setlogo_num parameter in the icp_setlogo_img (sub_41DBF4) function