EUVD-2026-60759
GHSA-2x4g-cqm2-c5vj
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-network vector (AV:A) per description; no authentication required (PR:N); scope change (S:C) because gateway device compromise affects traffic and systems on the downstream segment.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulnerability is an unknown functionality of the file /sbin/netifd of the component DHCP blobmsg Handler. The manipulation leads to stack-based buffer overflow. The attack must be carried out from within the local network. The exploit has been disclosed publicly and may be used.
AnalysisAI
Stack-based buffer overflow in the DHCP blobmsg handler within /sbin/netifd on TRENDnet TEW-WLC100P firmware 12.07b01 allows unauthenticated adjacent-network attackers to execute arbitrary code with no user interaction required. A working proof-of-concept Python exploit script has been publicly released on GitHub, materially lowering the skill threshold for exploitation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to reside on the same Layer 2 network segment as the TEW-WLC100P (AV:A), meaning they must be capable of delivering crafted DHCP traffic directly to the device - this precludes direct exploitation from the public internet but is achievable from any host on the same broadcast domain, including wireless clients associated to the device's own SSID. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.6 with full High impact across all six dimensions (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) reflects the severity of unauthenticated arbitrary code execution on a network gateway device, where compromise extends to downstream systems on the network segment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained access to the same local network segment as a TRENDnet TEW-WLC100P running firmware 12.07b01 - for example, a rogue wireless client or a compromised wired endpoint - runs the publicly available poc-netifd-overflow.py script from GitHub against the device's IP address. The script sends a crafted DHCP message containing an oversized blobmsg field that overflows the stack buffer in /sbin/netifd, overwrites the return address with attacker-controlled data, and redirects execution to a shellcode payload, achieving remote code execution on the gateway with no authentication required. |
| Remediation | No vendor-released patch has been identified at time of analysis; the NVD CPE wildcard and absence of a fix version in the provided references indicate TRENDnet has not published a patched firmware release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all TRENDnet TEW-WLC100P devices running firmware 12.07b01, segregate them from production networks, and disable services where operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Stack Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today