CVE-2026-5183 is an OS command injection (CWE-77) in TRENDnet TEW-713RE up to version 1.02, in the /goform/addRouting handler. NVD scores it 6.3 medium. The record says the vendor did not respond to the disclosure, so no fix is known. Limit access to the device and plan its replacement.
What's affected
TRENDnet TEW-713RE, a wireless range extender, up to firmware version 1.02. The record names the function sub_421494 and the dest argument of /goform/addRouting as the entry point.
The record says the vendor was contacted early and did not respond in any way, and it names no patched firmware. The scoring requires low privileges, so an attacker would need a login first.
How to check if you're exposed
Read the firmware version from the device's admin page and compare it with 1.02.
Because the flaw needs a login, check who can reach the admin page and what the password is. Devices left on a default password are the easiest to reach.
You can also run the free in-browser dependency scan or browse the Gold directory to see where this component shows up in your stack.
What to do now
- Find every TEW-713RE on your networks.
- Change the admin password to a unique, long one and disable remote administration.
- Keep the extender on a segment with no access to sensitive systems.
- Check the TRENDnet site for newer firmware before you rely on this list, since none is named in the record.
- Plan to replace the device if no update appears.
Why it matters
The public write-up says the dest value is concatenated into a buffer with no length check and then passed to a system call that runs a command. That means one parameter leads to two bugs, a stack overflow and a command injection (CWE-77, in the injection class CWE-74).
The record does not flag exploitation in the wild and it is not in the CISA KEV catalog, but the exploit details are public. The unanswered disclosure matters more than the score: with no vendor fix, defense is limited to access control and replacement.
Quick check
Why is the score only medium?
The scoring assumes the attacker has a login. Weak or default passwords change that in practice.
Will the vendor patch it?
The record says the vendor did not respond. Check for any later notice.
Sources
Last reviewed: 19 October 2026.
