One Request to Rule Them All: Critical Trendnet Flaw (CVE-2025-15471) Allows Total Takeover

A critical pre-authentication command injection (CVE-2025-15471, CVSS 9.8) in the Trendnet TEW-713RE Wi‑Fi extender allows unauthenticated remote attackers to execute arbitrary shell commands as root via the /goformX/formFSrvX endpoint (SZCMD parameter). A researcher demonstrated exploitation in a firmware simulation; successful exploitation can fully compromise the device, enable backdoors, intercept traffic, or be used as a pivot into the local network. The report recommends removing direct shell execution, enforcing authentication, whitelisting commands, and running services with least privilege, and advises users to restrict management interface exposure until a patched firmware is available.