Which versions of TRENDnet TEW-821DAP are affected by CVE-2026-15484?

TRENDnet TEW-821DAP wireless access points (firmware 1.12B01) contain a buffer overflow vulnerability (CVSS 8.7) in the network configuration handler that can enable remote code execution when…. A patch is available.

How to fix or mitigate CVE-2026-15484?

Within 24 hours: Audit network inventory to identify and document all TEW-821DAP devices currently deployed and their administrative access controls. Within 7 days: Implement emergency network segmentation or firewall rules to restrict access to the device's web management interface (/goform handlers) to authorized administrative users only, and disable remote management if enabled. Within 30 days: Execute replacement procurement and staged migration to vendor-supported access point models with current security patches.

TRENDnet TEW-821DAP CVE-2026-15484

Q: What is the CVSS score of CVE-2026-15484?

CVE-2026-15484 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-43206 HIGH

Classic Buffer Overflow (CWE-120)

2026-07-12 VulDB

GHSA-98p4-49cg-c9qh

Buffer Overflow Tew 821Dap Trendnet

8.7

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable web endpoint with low complexity and no UI, but the admin/diagnostic interface requires privileges (PR:L); a buffer overflow plausibly yields full C/I/A impact on the device.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 12, 2026 - 07:01 vuln.today

DescriptionCVE.org

A vulnerability was detected in TRENDnet TEW-821DAP 1.12B01. The affected element is the function sub_41EC14 of the file /goform/tools_nslookup of the component ssi. The manipulation results in buffer overflow. It is possible to launch the attack remotely. The vendor explains: "We are unable to confirm the existence of the vulnerabilities for (...) TEW-821DAP (v1.0R) as these items have been EOL. " This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Buffer overflow in the TRENDnet TEW-821DAP (firmware 1.12B01) wireless access point lets an authenticated remote attacker corrupt memory through the ssi-driven /goform/tools_nslookup handler (function sub_41EC14), enabling likely remote code execution or device crash. The device is end-of-life and the vendor has stated it cannot confirm or fix the issue, so no official patch is expected. A public technical write-up describing the overflow exists on GitHub (VulDB-coordinated disclosure), but there is no confirmed active exploitation in CISA KEV.

Technical ContextAI

The affected component is the SSI (Server-Side Includes) engine of TRENDnet's embedded HTTP management server, specifically the /goform/tools_nslookup endpoint that exposes an nslookup diagnostic tool. The vulnerable routine sub_41EC14 processes attacker-supplied input (a hostname/target parameter) and copies it into a fixed-size stack or global buffer without adequate bounds checking, matching CWE-120 (Classic Buffer Overflow / copy without size check). On typical SOHO/embedded MIPS or ARM router firmware these handlers run as root or a privileged web daemon with no memory protections (no ASLR/stack canaries by default), so overflowing the buffer can overwrite the return address and pivot to code execution. The CPE cpe:2.3:a:trendnet:tew-821dap:*:*:*:*:*:*:*:* covers the TEW-821DAP application/firmware family; the disclosure specifically names build 1.12B01.

RemediationAI

No vendor-released patched firmware version has been identified - the intelligence flag 'Patch: Available from vendor' conflicts with the vendor's EOL statement that it cannot confirm or address the flaw, and the cited GitHub link is a disclosure write-up rather than a fixed build, so treat this as No vendor-released patch identified at time of analysis. Because the device is unsupported, the primary recommendation is to retire and replace the TEW-821DAP with a currently-supported access point. As compensating controls until replacement: restrict access to the web management interface to a dedicated management VLAN or trusted admin hosts only (side effect: remote admin convenience is lost); ensure the device is never reachable from the WAN/Internet and block inbound access to the HTTP/HTTPS admin ports at the perimeter; disable remote administration if enabled; and change default/weak admin credentials to reduce the chance an attacker satisfies the PR:L authentication requirement. Monitor for the eventual publication of any TRENDnet advisory at https://vuldb.com/cve/CVE-2026-15484. Avoid exposing the nslookup diagnostic tooling to untrusted users.