TRENDnet TV-IP751WIC CVE-2026-76584

Exploitation requires network reachability to the camera's web management interface and valid low-privilege credentials (confirmed by PR:L in the CVSS 4.0 vector). The vulnerable code path is triggered via the Currenttime parameter in the /cgi-bin/admin/set_time.cgi CGI handler - no special non-default camera configuration is required beyond the web interface being accessible. Factors that limit exploitation: the PR:L requirement means unauthenticated exploitation is not supported by the available data - an attacker must first acquire valid login credentials; cameras placed behind NAT without port forwarding, or on isolated IoT VLANs with no management-plane access from untrusted networks, are not directly reachable. Cameras using non-default, unique credentials are harder to compromise at the credential-acquisition stage, though the overflow itself imposes no additional configuration prerequisite once authenticated access is achieved.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) places exploitation within reach of any attacker who obtains low-privilege credentials - no special conditions, no user interaction, no complex attack preparation. The E:P supplemental metric aligns with the confirmed public POC, which materially lowers the attacker skill bar. High impact across all six CIA metrics (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) reflects not just full camera compromise but potential for network-level lateral movement from a pivoted device. EPSS data was not supplied; given the public POC and the ease of exploitation, a moderate-to-elevated EPSS score would be expected. The absence of a CISA KEV listing means active mass exploitation is not confirmed, but the public exploit makes opportunistic targeting realistic. IP cameras are routinely under-segmented in enterprise and SMB environments, and even a small IT team managing a distributed camera deployment should treat this as an urgent remediation priority given the combination of network accessibility, low privilege requirement, and full-compromise impact. Note: the CVSS wildcard CPE suggests broader version impact than just 11.03.03, but this is not independently confirmed.

An attacker who has obtained low-privilege credentials to the TV-IP751WIC web interface - through credential stuffing, default password use, or prior phishing - sends an HTTP POST request to /cgi-bin/admin/set_time.cgi with an oversized Currenttime parameter, triggering a stack buffer overflow in alphapd. The attacker overwrites the return address with a controlled value, redirecting execution to shellcode or a ROP gadget chain, achieving arbitrary code execution with alphapd's runtime privileges on the camera. The public proof-of-concept script (poc-time-injection.py at https://github.com/meishigana/CVE/blob/main/team15_20260702/07_751wic-apd-time-cmdi/poc/poc-time-injection.py) automates this attack.