CVE-2021-28844
📋 TL;DR
This vulnerability allows remote attackers to cause a denial-of-service (DoS) condition by sending a specially crafted POST request to the apply_cgi endpoint without a session_id parameter. It affects TRENDnet wireless access points running specific firmware versions. Attackers can crash the device, disrupting network connectivity.
💻 Affected Systems
- TRENDnet TEW-755AP
- TRENDnet TEW-755AP2KAC
- TRENDnet TEW-821DAP2KAC
- TRENDnet TEW-825DAP
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device crash requiring physical reboot, causing extended network downtime for all connected users.
Likely Case
Temporary service disruption until device automatically reboots or is manually restarted.
If Mitigated
Minimal impact if devices are behind firewalls with restricted WAN access and proper network segmentation.
🎯 Exploit Status
Exploit requires sending a single HTTP POST request to a known endpoint. No authentication or special tools needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not publicly available
Restart Required: No
Instructions:
Check TRENDnet support for firmware updates. If available, download latest firmware from vendor website, upload via web interface, and apply update.
🔧 Temporary Workarounds
Disable Web Management Interface
allDisable the web management interface if not needed for administration
Access device web interface > Administration > Management > Disable Web Management
Restrict Management Access
linuxConfigure firewall rules to restrict access to management interface
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Place devices behind firewalls with strict inbound rules blocking external access to management interfaces
- Implement network segmentation to isolate vulnerable devices from critical network segments
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface: Login > Status > Firmware. If version is 1.11B03, device is vulnerable.Check Version:
curl -s http://device-ip/status.cgi | grep -i firmwareVerify Fix Applied:
Verify firmware version has been updated to a version later than 1.11B03📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /apply_cgi with do_graph_auth action missing session_id parameter
- Device crash/reboot logs
Network Indicators:
- HTTP POST to device IP on port 80 with payload containing 'do_graph_auth' without 'session_id'
SIEM Query:
source="apache" OR source="device_logs" AND (uri="/apply_cgi" AND method="POST" AND params CONTAINS "do_graph_auth" AND NOT params CONTAINS "session_id")