CVE-2026-76591

CVE-2026-76591 is a command injection vulnerability in the TRENDnet TEW-755AP's web interface (firmware 20260702) affecting the log_email_server function accessible through email.cgi. The flaw scores 7.4 CVSS and allows unauthenticated remote code execution by injecting shell commands into email server configuration parameters—likely through direct string concatenation in the underlying C code without input sanitization. The root cause is not exotic: Server-Side Includes (SSI), a deprecated 1990s execution context that mainstream web servers abandoned precisely because it allows server-side execution from user input, remains active in this 2026 firmware. SSI was deprecated in Apache 2.4 and never part of nginx's design—its persistence in SOHO router firmware represents entropy, not engineering necessity. The email logging function sits at the network perimeter with unauthenticated CGI access, meaning compromise of this device exposes the entire network segment behind it and provides WAN-facing pivot capability without credentials. This vulnerability belongs to a documented lineage: CVE-2002-1235, CVE-2009-4235, CVE-2014-9729, and CVE-2019-12260 all exploited command injection through shell concatenation in SOHO firmware web interfaces. The fix is straightforward—input validation and avoiding shell calls—but the pattern persists because the IoT supply chain selects for rapid feature delivery over security hygiene. The TEW-755AP is likely end-of-life hardware with no vendor support for patches. For defenders: identify any TRENDnet SOHO devices in your environment and verify firmware version; assume compromise if the device is accessible from untrusted networks; network-segment IoT devices from core infrastructure assuming they are already compromised; and replace end-of-life network equipment rather than attempting remediation. The existence of public exploits for this class indicates active targeting—waiting for a patch that may never arrive is not a viable strategy.

Reviewed through automated stages and approved by a human before publication.