Skip to main content

TRENDnet TV-IP751WIC CVE-2026-76583

| EUVDEUVD-2026-63083 LOW
Command Injection (CWE-77)
2026-08-19 VulDB GHSA-xgq8-7373-6452
Command Injection Tv Ip751Wic
2.1
CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY
2.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

Network-accessible CGI with PR:L; command injection on embedded Linux typically yields full device control, warranting C:H/I:H/A:H despite conservative vendor VC:L/VI:L/VA:L scoring.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Analysis Generated
Aug 19, 2026 - 21:45 vuln.today
Severity Changed
Aug 19, 2026 - 21:22 NVD
MEDIUM LOW
CVSS changed
Aug 19, 2026 - 21:22 NVD
5.3 (MEDIUM) 2.1 (LOW)
CVE Published
Aug 19, 2026 - 20:45 cve.org
LOW 2.1

DescriptionCVE.org

A vulnerability was identified in TRENDnet TV-IP751WIC 11.03.03. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/admin/set_time.cgi of the component alphapd. The manipulation leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used.

AnalysisAI

Command injection in TRENDnet TV-IP751WIC firmware 11.03.03 enables remote authenticated attackers to execute arbitrary OS commands through the /cgi-bin/admin/set_time.cgi endpoint handled by the alphapd daemon. The flaw stems from unsanitized user input passed directly to a shell command in the time-setting CGI handler. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify camera admin interface on network
Delivery
Authenticate with valid or default credentials
Exploit
Submit crafted time parameter to /cgi-bin/admin/set_time.cgi
Execution
alphapd passes input unsanitized to OS shell
Impact
Execute arbitrary commands on embedded Linux device
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires low-privilege authenticated access to the camera's administrative web interface, as reflected by PR:L in the CVSS 4.0 vector - unauthenticated exploitation is not supported by the available data. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The provided CVSS 4.0 score of 2.1 with VC:L/VI:L/VA:L appears to materially underestimate the real-world impact of a successful command injection on an embedded Linux device, where alphapd commonly runs with root or near-root privileges - full device compromise is the realistic outcome, not limited partial impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained valid admin credentials - whether through credential stuffing, default password reuse, or prior compromise - sends a crafted HTTP request to /cgi-bin/admin/set_time.cgi with a time parameter containing injected shell metacharacters. The alphapd daemon passes the unsanitized value to an OS command, executing attacker-supplied commands in the device context. …
Remediation No vendor-released patch has been identified at time of analysis - no TRENDnet advisory or fixed firmware version appears in the reference data. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Tv Ip751Wic

View all
CVE-2026-76584 HIGH POC
8.6 Aug 19

Stack-based buffer overflow in TRENDnet TV-IP751WIC firmware 11.03.03 allows remote low-privileged attackers to achieve

Same weakness CWE-77 – Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2017-6327 HIGH POC
8.8
CVE-2023-34960 CRITICAL POC
9.8
CVE-2023-37679 CRITICAL POC
9.8

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Share

CVE-2026-76583 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy