TRENDnet TEW-755AP CVE-2026-76589

Exploitation requires network-level reachability to the TEW-755AP management interface and at least low-privilege authentication (confirmed by PR:L in the CVSS 4.0 vector). The attacker must be able to invoke /sbin/mycli and supply a crafted ssid argument. No user interaction is required (UI:N) and no special attack prerequisites apply (AT:N), meaning the exploit is straightforward once authentication is satisfied. Exploitation is bounded by the PR:L requirement - entirely unauthenticated remote exploitation is not confirmed from the available data. Devices with default credentials, weak passwords, or management interfaces exposed to untrusted networks face the greatest practical risk. There is no indication that a non-default configuration is required; the vulnerability appears present in the default firmware build.

The CVSS 4.0 score of 8.6 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H reflects network-accessible, low-complexity exploitation requiring only low-privilege authentication, with complete impact across both the vulnerable device and subsequent systems it bridges. The E:P supplemental metric confirms a public exploit exists. The PR:L authentication prerequisite modestly constrains opportunistic mass scanning but does not significantly limit a motivated attacker, as default or weak credentials are common on consumer-grade access points. No CISA KEV listing was present in the provided data, so confirmed in-the-wild exploitation is unverified; however, the combination of a public Python POC, no available patch, and a network-accessible attack vector makes this a genuine near-term priority for any operator running this device. EPSS data was not provided, so probabilistic exploitation likelihood cannot be quantified. The scope change metrics (SC:H/SI:H/SA:H) are consistent with the device's role as a network infrastructure component whose compromise affects all traffic traversing it.

An attacker with low-level access to the TEW-755AP management interface - for example, using default credentials or credentials obtained through prior reconnaissance - invokes the /sbin/mycli CLI and passes a crafted ssid value significantly exceeding the expected buffer length. The oversized input overwrites the stack frame in FUN_401000, corrupting the return address and redirecting execution to attacker-controlled code. The publicly available poc-mycli-overflow.py on GitHub demonstrates this technique, meaning the barrier to reproduction is low for anyone with device access.