EUVD-2026-58663
GHSA-jj6h-h6xp-phmh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable bftpd FTP service exploitable without credentials; impact confined to low availability loss on the vulnerable device with no confidentiality or integrity effects.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was found in TRENDnet TEW-816DRM GURNC4.OT182B-C-TN-R1B028-US.EN. This impacts an unknown function of the file /etc/bftpd.conf of the component bftpd. The manipulation of the argument USERLIMIT_GLOBAL results in allocation of resources. It is possible to launch the attack remotely. This vulnerability only affects products that are no longer supported by the maintainer.
AnalysisAI
Remote resource exhaustion in the TRENDnet TEW-816DRM router's bftpd FTP service allows unauthenticated remote attackers to cause a denial-of-service condition by exploiting improper handling of the USERLIMIT_GLOBAL configuration parameter in /etc/bftpd.conf. The vulnerability, classified as CWE-400 (Uncontrolled Resource Consumption), affects the end-of-life firmware GURNC4.OT182B-C-TN-R1B028-US.EN, and no vendor patch will ever be issued. Proof-of-concept exploit code is publicly available per the CVSS 4.0 E:P supplemental metric, lowering the technical bar for exploitation.
Technical ContextAI
The affected component is bftpd, a lightweight FTP server daemon bundled with the TRENDnet TEW-816DRM wireless router firmware GURNC4.OT182B-C-TN-R1B028-US.EN. The bftpd.conf configuration file includes the USERLIMIT_GLOBAL directive, which is intended to cap the number of concurrent global FTP connections allowed by the service. CWE-400 (Uncontrolled Resource Consumption) indicates this limit is not properly enforced at runtime, enabling an attacker to exhaust device resources such as memory or process table entries by opening excessive concurrent connections. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the bftpd service is network-reachable without authentication and the attack requires no special preconditions. No CPE string was included in the available intelligence data, limiting precise version scoping beyond the firmware string provided.
RemediationAI
No vendor-released patch is available for CVE-2026-19830, as the TRENDnet TEW-816DRM is an end-of-life product that TRENDnet no longer supports and for which no fix will be issued. Device replacement with a currently supported router model is the only definitive remediation. Where immediate replacement is not feasible, the following compensating controls should be applied in order of preference: disable the bftpd FTP service entirely if FTP-based functionality is not operationally required - this eliminates the attack surface but removes FTP management capability from the device; block inbound TCP port 21 at the network perimeter or on an upstream firewall to prevent remote exploitation - note this does not protect against LAN-side attackers and does not address the underlying flaw; restrict device management and service access to trusted internal IP ranges to reduce exposure. See VulDB advisory at https://vuldb.com/vuln/389971 for additional context.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today