CVE-2026-108804 is a critical (CVSS 3.1: 10.0) OS command injection flaw that can be exploited remotely. It affects the web management backend of several TRENDnet routers that are no longer supported, and a public exploit is available. TRENDnet's statement on the issue says the router reached end of life in 2011.
What Is It
The flaw is in the fwrite function of pigwidgeon.cgi, which is part of the Web Management Backend on the affected TRENDnet routers. An attacker who manipulates the service argument can inject operating system commands. The weakness is classified as CWE-77 (Command Injection) and CWE-78 (OS Command Injection).
VulDB, the CNA, published the record on 2026-10-12. NVD lists its status as "Received" and has not yet analyzed it.
Why It Matters
- Remote, no authentication: The CVSS 3.1 vector (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) means the attack runs over the network, needs no privileges or user interaction, and is low in complexity. - Severity: It scores 10.0 (Critical) under CVSS 3.1, 9.3 (Critical) under CVSS 4.0, and 10.0 under CVSS 2.0.
- Public exploit: The NVD description says the exploit "is now public and may be used." The CVSS 4.0 exploit maturity is rated Proof-of-Concept, and the exploit code is in a public GitHub repository.
- KEV status: This CVE has no entry in CISA's Known Exploited Vulnerabilities catalog. KEV does not confirm active exploitation in the wild.
What's Vulnerable
The affected products are these TRENDnet devices running firmware 1.03B01 and 1.03B03:
- TEW-751DR
- TEW-752DRU
- TEW733GR
The vulnerable component is the Web Management Backend (pigwidgeon.cgi). The CNA tagged the CVE "unsupported-when-assigned", meaning the products were already out of support when the CVE was assigned.
Patch Status
The source data includes no patch or fixed firmware version. The vendor statement reads: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product." The statement refers to a single router. It does not give end-of-life dates for each of the three models. The record also states the vulnerability "only affects products that are no longer supported by the maintainer."
Because there is no KEV entry, no CISA-required action or due date applies. No vendor fix is available and a public exploit exists, so organizations still running these models should plan to retire and replace them.