TRENDnet TV-IP751WIC CVE-2026-76583

Exploitation requires low-privilege authenticated access to the camera's administrative web interface, as reflected by PR:L in the CVSS 4.0 vector - unauthenticated exploitation is not supported by the available data. The vulnerable endpoint /cgi-bin/admin/set_time.cgi must be network-reachable, which is the case by default for any camera whose admin interface is accessible on the LAN or internet. No special device configuration or non-default feature must be enabled beyond standard camera operation. Limiting factors: the attacker must possess valid credentials, reducing mass-scanning exploitation risk; however, TRENDnet consumer cameras frequently ship with well-known default credentials, substantially lowering this barrier. Platform is constrained to TV-IP751WIC firmware 11.03.03 (and potentially adjacent versions).

The provided CVSS 4.0 score of 2.1 with VC:L/VI:L/VA:L appears to materially underestimate the real-world impact of a successful command injection on an embedded Linux device, where alphapd commonly runs with root or near-root privileges - full device compromise is the realistic outcome, not limited partial impact. PR:L correctly reflects that low-privilege authenticated access is required, which limits mass opportunistic exploitation, but any attacker with valid credentials (default credentials are endemic on consumer IP cameras) faces a low bar. A public PoC script (poc-time-injection.py on GitHub) is confirmed, accelerating exploitation timelines. No EPSS data was provided. No CISA KEV listing exists, suggesting exploitation has not yet been observed at scale. The realistic risk is elevated above the raw CVSS score suggests, particularly in environments where the camera admin interface is internet-exposed or where default credentials have not been changed.

An attacker who has obtained valid admin credentials - whether through credential stuffing, default password reuse, or prior compromise - sends a crafted HTTP request to /cgi-bin/admin/set_time.cgi with a time parameter containing injected shell metacharacters. The alphapd daemon passes the unsanitized value to an OS command, executing attacker-supplied commands in the device context. A public Python PoC (poc-time-injection.py) demonstrates this technique and is available on GitHub, making reliable exploitation accessible to low-skill threat actors.