EUVD-2026-63094
GHSA-g7xg-mvgf-qr55
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible CGI endpoint requires only low-privilege credentials; full device compromise with network-pivot potential warrants S:C and H across all CIA metrics.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A security flaw has been discovered in TRENDnet TV-IP751WIC 11.03.03. Affected by this issue is some unknown functionality of the file /cgi-bin/admin/set_time.cgi of the component alphapd. The manipulation of the argument Currenttime results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
AnalysisAI
Stack-based buffer overflow in TRENDnet TV-IP751WIC firmware 11.03.03 allows remote low-privileged attackers to achieve arbitrary code execution by sending a crafted value in the Currenttime parameter to the /cgi-bin/admin/set_time.cgi endpoint handled by the alphapd daemon. The CVSS 4.0 score of 8.6 reflects high impact across confidentiality, integrity, and availability for both the compromised device and subsequent systems in its network segment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the camera's web management interface and valid low-privilege credentials (confirmed by PR:L in the CVSS 4.0 vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) places exploitation within reach of any attacker who obtains low-privilege credentials - no special conditions, no user interaction, no complex attack preparation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained low-privilege credentials to the TV-IP751WIC web interface - through credential stuffing, default password use, or prior phishing - sends an HTTP POST request to /cgi-bin/admin/set_time.cgi with an oversized Currenttime parameter, triggering a stack buffer overflow in alphapd. The attacker overwrites the return address with a controlled value, redirecting execution to shellcode or a ROP gadget chain, achieving arbitrary code execution with alphapd's runtime privileges on the camera. … |
| Remediation | No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all TRENDnet TV-IP751WIC cameras and identify any running firmware 11.03.03; immediately isolate affected devices to a segregated VLAN with restricted network access to contain potential compromise. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Tv Ip751Wic
View allSame weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Stack Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today