TRENDnet TEW-821DAP CVE-2026-15484

Exploitation requires network reachability to the TEW-821DAP HTTP management interface and the ability to invoke the /goform/tools_nslookup endpoint backed by function sub_41EC14 in the ssi component; per CVSS PR:L, some authenticated/privileged access to the web UI is needed, so this is not an unauthenticated-against-default attack. Limiting factors that reduce real-world exposure: the management interface must be reachable by the attacker (LAN by default rather than WAN, unless remote admin is enabled), valid low-privilege credentials are required, and the affected model is EOL with a shrinking installed base. Aggravating factors: no user interaction is required (UI:N) and attack complexity is low (AC:L), so once an attacker reaches an authenticated session, triggering the overflow is straightforward.

The CVSS 4.0 base score is 8.7 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N and full VC:H/VI:H/VA:H impact, indicating network-reachable, low-complexity exploitation that nonetheless requires some level of privileges (PR:L) - consistent with the endpoint living behind an authenticated web-management session rather than being fully anonymous. No EPSS score, SSVC decision, or KEV listing was provided, so probabilistic and government-exploitation signals are absent. A public GitHub write-up of the overflow exists, raising the practical likelihood that working exploit details are available, but this is distinct from confirmed in-the-wild use. Key conflict to flag: the intelligence says 'Patch: Available from vendor,' yet the vendor's own statement declares the product EOL and says it cannot confirm the vulnerability - these are contradictory, and the referenced 'patch' link is actually a third-party disclosure document, not a vendor fix. Net: a genuine, likely-exploitable flaw on an unsupported device, so real-world risk depends heavily on how many of these APs remain deployed and internet-exposed.

An attacker who can reach the device's web management interface and holds (or brute-forces/reuses) valid credentials sends a crafted request to /goform/tools_nslookup with an over-long target parameter, overflowing the buffer handled by sub_41EC14. This corrupts control-flow data in the SSI/web daemon, crashing the service or, with a tuned payload, executing attacker code on the AP. A public technical write-up documenting the overflow increases the ease of reproducing this against exposed or LAN-adjacent devices.