CVE-2026-77988

The command injection vulnerability in the CLI Configuration Tool's nvram_get function on the TEW-823DRU (firmware 1.1.02b01) represents a high-impact flaw that the CVSS 6.6 score substantially understates. This is not a contained host compromise — a compromised NAT gateway gives an attacker a passive pivot point for DNS manipulation and traffic interception across every device on the LAN. The critical exposure mechanism is the NVRAM persistence layer itself. Unlike a transient exploit that leaves no trace, corrupted NVRAM contents deliver the injection payload on every boot, every firmware update, and even through most factory resets that preserve calibration data. If an attacker achieves write access to nvram_set through any vector — even temporarily — the nvram_get retrieval pathway becomes a persistent, reboot-surviving command injection channel that no ordinary patch cycle addresses. Defenders should audit the firmware for ALL nvram_* function consumers, not just the nvram_get call identified in this CVE. The pattern of NVRAM-to-shell interpolation has recurred across vendor SDKs for twenty years, and patching a single retrieval site without auditing other consumers leaves parallel injection pathways intact. The CLI Configuration Tool specifically warrants scrutiny because embedded CLI interfaces often receive worse input validation than web interfaces, yet are exposed with default credentials in production. Prioritize network-segment isolation behind these devices rather than relying on patch deployment timelines. The 'b01' beta designation signals that this firmware likely shipped without intended stable-release hardening, and the device is probably end-of-life with no vendor patch coming. Assume a multi-year unpatched deployment horizon and architect network defenses accordingly — the exposure window compounds with each day between disclosure and any hypothetical remediation.

Reviewed through automated stages and approved by a human before publication.