CVE-2021-20155

Vulnerability

The Trendnet AC2600 TEW-827DRU router, firmware version 2.08B01, encrypts device configuration backups using a hardcoded password of 12345678 [1]. The management web interface provides functionality to backup and restore these configurations, which are protected solely by this static credential.

Exploitation

An attacker with network access to the router's management interface can request a configuration backup file. Because the backup is encrypted with the known, hardcoded password, the attacker can decrypt the backup and extract sensitive data (e.g., passwords, network settings). The attacker may also craft a malicious configuration file, encrypt it with the same hardcoded password, and upload it via the restore function to alter device behavior.

Impact

Successful exploitation allows an unauthenticated, remote attacker to (1) read sensitive information from a decrypted configuration backup, including credentials and network secrets, and (2) restore a modified configuration, potentially gaining persistent control over the device [1]. This leads to complete compromise of confidentiality, integrity, and availability of the router.

Mitigation

No fixed firmware version has been disclosed by Trendnet as of the advisory publication date (2021-12-30). Administrators should restrict management interface access to trusted IPs only, disable remote management if not required, and consider isolating the device from untrusted networks until a patch becomes available [1].