What is CVE-2021-20165?

CVE-2021-20165 is a high-severity vulnerability in Trendnet Tew-827dru, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2021-12-30.

How severe is CVE-2021-20165?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2021-20165 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

CSRF in Trendnet Tew-827dru

CVE-2021-20165

Trendnet AC2600 TEW-827DRU version 2.08B01 does not properly implement csrf protections. Most pages lack proper usage of CSRF protections or mitigations. Additionally, pages that do make use of CSRF tokens are trivially bypassable as the s…

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.006 (45.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Trendnet Tew-827dru — versions 2.0
Trendnet Tew-827dru_firmware — versions 2.08b01
N/a Trendnet Ac2600 Tew-827dru — versions 2.08B01

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

Public proof-of-concept exploits

References

vulnreport@tenable.com (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-20165?: CVE-2021-20165 is a high-severity vulnerability in Trendnet Tew-827dru, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2021-12-30.
How severe is CVE-2021-20165?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2021-20165 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.