TRENDnet TV-IP751WIC CVE-2026-75877

Exploitation requires low-privileged authenticated access to the alphapd web management interface of the TV-IP751WIC, as confirmed by PR:L in the CVSS 4.0 vector - an attacker must hold valid (but not administrator-level) credentials. The device must be reachable over a network (AV:N); no physical access is required. No special non-default configuration is needed beyond the device being powered on and the management interface accessible, as all seven affected functions are part of standard device operation. Exploitation is constrained by the authentication requirement: devices with changed default credentials are harder to target opportunistically. Devices exposed directly to the internet or deployed on flat networks without management-plane access controls face the greatest risk. There is no user interaction required (UI:N) and no specific attack prerequisite beyond network reachability and credential possession (AT:N).

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P) conveys a network-exploitable, low-complexity flaw requiring only low-privilege access with no user interaction. The SC:H/SI:H/SA:H subsequent-system impact metrics reflect the risk that a compromised camera - typically a trusted network sensor - can be pivoted against adjacent hosts or used as a persistent foothold. The E:P (proof of concept) modifier confirms a working exploit is publicly available, materially lowering the bar for exploitation. No EPSS data was provided in the input, so exploitation probability cannot be quantified. The vulnerability is not currently listed in CISA KEV, indicating no confirmed at-scale in-the-wild exploitation at time of analysis, but the public POC and the product's typical deployment in flat SMB and home networks represent compounding risk factors. The PR:L authentication requirement is a real but weak barrier given widespread default-credential use on IoT devices. This is a genuine priority for any organization with internet-exposed or default-credential TV-IP751WIC cameras.

An attacker with low-privileged access to the camera's web management interface - obtained via default credentials, brute force, or credential reuse - sends a crafted HTTP POST request to a configuration endpoint (such as DDNS or FTP settings) containing an excessively long field value. The alphapd daemon copies this input into a fixed-size stack buffer in the corresponding handler function (e.g., SystemDDNSChanged), overwriting the saved return address and redirecting execution to attacker-controlled shellcode or a ROP chain, achieving arbitrary code execution on the device. The public POC at https://github.com/meishigana/CVE/blob/main/team15_20260702/09_751wic-apd-password-overflow/poc/poc-password-overflow.py demonstrates this technique against the password-processing code path.