CVE-2025-2960
TRENDnet TEW-637AP/TEW-638APB HTTP Request goahead sub_41DED0 null pointer dereference
- State
- Published
- Severity
- 7.1 High
- Published
- Mar 30, 2025
- Updated
- Mar 31, 2025
- Reserved
- Mar 29, 2025
Description
A vulnerability classified as problematic has been found in TRENDnet TEW-637AP and TEW-638APB 1.2.7/1.3.0.106. This affects the function sub_41DED0 of the file /bin/goahead of the component HTTP Request Handler. The manipulation leads to null pointer dereference. Access to the local network is required for this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulDB |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | VulDB |
| 3.0 | 6.5 Medium | CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | VulDB |
| 2.0 | 6.1 Medium | AV:A/AC:L/Au:N/C:N/I:N/A:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
TEW-637APTRENDnet |
|
TEW-638APBTRENDnet |
|
References
- VDB-302013 | TRENDnet TEW-637AP/TEW-638APB HTTP Request goahead sub_41DED0 null pointer dereferencevdb-entrytechnical-description
- VDB-302013 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- Submit #521727 | TRENDnet wi-fi access point TEW_637AP_V2_FW1.3.0.106/FW_TEW_638APB_V2_1.2.7 NULL Pointer Dereferencethird-party-advisory
- https://docs.google.com/document/d/17FadWn-UWXjvcYNzDI4JRjag-lGUU9pJ/edit#heading=h.gjdgxsrelated
- https://drive.google.com/file/d/1SS7jsYBNl0faSOy_vH5tNn_xJJ_HA1xU/view?usp=drive_linkexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.