---
id: CVE-2025-15472
title: A flaw has been found in TRENDnet TEW-811DRU 1.0.2.0
summary: "A flaw has been found in TRENDnet TEW-811DRU 1.0.2.0. This affects the function setDeviceURL\_ of the file uapply.cgi of the component httpd\_. This manipulation of the argument DeviceURL causes os command injection. The attack can be init…"
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-77
  - CWE-78
  - CWE-78
vendor: trendnet
product: tew-811dru_firmware
affected:
  - tew-811dru_firmware = 1.0.2.0
published: '2026-01-07'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T22:10:00.273'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-15472'
references:
  - url: >-
      https://pentagonal-time-3a7.notion.site/TrendNet-TEW-811DRU-2d2e5dd4c5a58016a612e99853b835f8
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?ctiid.339722'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?id.339722'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?submit.721874'
    label: cna@vuldb.com
tags:
  - nvd
epss: 0.22632
epssPercentile: 0.97654
ingestedAt: '2026-09-30T22:27:27.718Z'
---

## Overview

A flaw has been found in TRENDnet TEW-811DRU 1.0.2.0. This affects the function setDeviceURL  of the file uapply.cgi of the component httpd . This manipulation of the argument DeviceURL causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Affected

- `tew-811dru_firmware = 1.0.2.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.