CVE-2025-65202

High · 8.0

CVSS

8.0

EPSS

6.7%

Published

Nov 26, 2025

CISA due date

—

The record

TRENDnet TEW-657BRM 1.00.1 has an authenticated remote OS command injection vulnerability in the setup.cgi binary, exploitable via the HTTP parameters "command", "todo", and "next_file," which allows an attacker to execute arbitrary commands with root privileges.

Affected packages

Ecosystem	Package	Introduced	Fixed